North Star pipeline
Ordered gates read from
_authorization_gate_phases() — not a hardcoded diagram.
Decision
——
Delegation authority
—Risk & security posture
Control plane write
Connect agents and author rules. Each action calls one existing public SDK method — no separate authorization logic.
Start with python -m firewall.ui --control. The token is
printed once and can mint authority — keep it local.
Global rules
Applied to every authorization.
Leave empty for unbounded. Enforced by the existing depth-policy gate, not here.
Propose a rule change simulate first
Replays the requests this console has authorized against the proposed rules, in throwaway workspaces, before anything takes effect. 0 recorded case(s) available — authorize a request above to record one.
Connected agents
0Control-plane audit
Every UI-originated action, accepted or rejected. Newest first.
Capabilities
Signatures and public keys are withheld by the projection layer.
Lifecycle & evidence
Append-only event record, newest first.
Authorization trace
Canonical SecurityDecision as returned.
—
Agent identity & supply chain v2.0
Agent identities with full lifecycle, verifiable security passports, and supply-chain provenance. Identity proves who; the authorization pipeline alone decides what.
Identities
Lifecycle, key fingerprints, parent/child. Mutations go through the control plane.
Security passport
Deterministic, signed summary of identity + posture.
Supply-chain provenance
Models, tools, MCP servers, skills, plugins, packages, adapters, configuration, policies. A name is never trust.
Security operations v1.9
Cross-agent security intelligence over verified artifacts: what agents can do, what they are doing, what could happen next, and how to respond safely.
Active agents
Reachable capability, tools, resources.
Suspicious behavior
Deterministic, evidence-backed detections.
Correlation
Artifacts grouped by shared identifiers.
Sensitive resources
Attack-path summary over recorded reach.
Attack paths
Recorded paths from an agent to a target, with break-path suggestions. Reachable is not exploitable.
Scenario simulator
What happens if this agent is compromised? Isolated workspaces only; never touches live state.
Security flight recorder v1.8
Portable, cryptographically verifiable security history. The artifact records what happened and why; verification, replay, and the graph are derived from recorded events only.
Agent security timeline
Every event is inspectable: from timeline to event to decision to authority chain to evidence.
Security trajectory
How posture changed, and the evidence for every transition.
Security relationship graph
Derived from recorded authority and decisions. Why could this agent do this? What could it reach?
Containment
Explicit state transitions, audited. Mutations go through the control plane.
Replay laboratory
Ask what would have happened under a different policy. Replay runs the real authorization pipeline in throwaway workspaces.
v2.1 Autonomous Defense v2.1
Defense mesh, a2a zero trust, attack graph, digital twin, evidence graph, immune system, and research lab - advisory and analytic layers above the authorization pipeline.
Live defense state (mesh).
Agent-to-agent trust relationships.
Attack-graph summary (reachability is not exploitability).
Digital twin counterfactuals.
Evidence graph (signed, tamper-evident).
Immune system: OBSERVE..VERIFY loop. Model output is advisory only; execution requires a policy rule.