AUTHORIZE / Public alpha
ScopeWrit
One action. Exact authority.
Sign the permitted scope of an agent run. Check each consequential action and consume its authorization once.
AVAILABLE IN THIS RELEASE
- Inspect unsigned YAML before signing; the public preflight grants no authority.
- Connect guarded HTTP to the checked IP while verifying the original TLS hostname.
- Serialize local recorder writers and recover signed run audits after interruption.
A deterministic DENY, PAUSE, or ALLOW, with a short-lived action ticket and audit trail.
- 01
Declare resources, methods, limits, run identity, and expiry.
- 02
Sign the manifest using your configured trust root.
- 03
Route proposals through the guarded adapter. Inspect the decision and consume-once ticket.
WHAT THIS DOES — AND WHAT IT DOESN’T
A useful tool has a clear boundary.
Every effectful path must pass through a guarded adapter. ScopeWrit does not transparently contain a process that retains raw shell or network access.