Skip to content
← All tools

AUTHORIZE / Public alpha

ScopeWrit

# One action. Exact authority.

Sign the permitted scope of an agent run. Check each consequential action and consume its authorization once.

Open ScopeWrit ↗Download this release’s source ↓

AVAILABLE IN THIS RELEASE

- Inspect unsigned YAML before signing; the public preflight grants no authority.
- Connect guarded HTTP to the checked IP while verifying the original TLS hostname.
- Serialize local recorder writers and recover signed run audits after interruption.

YOU BRING

## A principal-signed scope manifest and a proposed action through a trusted adapter.

YOU GET

## A deterministic DENY, PAUSE, or ALLOW, with a short-lived action ticket and audit trail.

YOUR FIRST RUN

## Get from idea
to an inspectable result.

Run the isolated benchmark →

1. 01

   Declare resources, methods, limits, run identity, and expiry.

2. 02

   Sign the manifest using your configured trust root.

3. 03

   Route proposals through the guarded adapter. Inspect the decision and consume-once ticket.

WHAT THIS DOES — AND WHAT IT DOESN’T

## A useful tool has a clear boundary.

Every effectful path must pass through a guarded adapter. ScopeWrit does not transparently contain a process that retains raw shell or network access.

← Explore the other tools Read the method →