Agenthof
An Apache-2.0 licensed open-source AI Agent governance plane that uses a 'gate' mechanism to authorize, inject credentials for and audit-account Agent model calls, tool calls, execution and derivation. The Agent itself holds no keys.
Timeline (last 90 days)
Agenthof is an open-source governance plane licensed under Apache-2.0, whose core claim is that the Agent is never trusted, but every request must pass through a door, and the door authorizes, injects credentials, and writes the ledger.
Agenthof splits the system into two completely independent programs: agenthof is the governance engine, responsible for apply, run, audit, and investigate, never embedding the Agent and never deciding how the Agent thinks; the Agent is a separate program (a small LangChain Agent in the repository), agenthof calls it over a socket and drives it with the model door, tool door, execution door, and spawn door.
The Agent runtime has no network, no keys of its own, and cannot directly call backend systems, and can only make requests to the doors; when it needs to operate on a system isolated per user, the gateway performs an RFC 8693 Token Exchange, exchanging the initiator's verified Token for a Token that acts on the upstream, and then calls the system as the initiator, with keys never entering the Agent process.
After a run ends, agenthof audit <run> prints that run's ledger in order, that is, the receipt, including the run ID, initiator, status, ledger integrity verification result, and records of each event (such as model, exec, tool, spawn, etc.).
In Agenthof's demonstration, a real model is given the Agent's actual capabilities as tools and decides round by round what to call; when the Agent oversteps, what stops it is the door, not a script; model-driven operation does not require adding new door types.
The Agentic loop means the model decides its next action each round based on the current context, the control flow is produced by the model, and the path is unpredictable; Agenthof governs by constraining the door of each call rather than constraining the model's thinking.
Agenthof's demonstration does not prove isolation: the isolation pod is a host process launched by a test double, and nothing in this run proves that the Agent cannot access the provider on its own; for this the project maintains a separate Podman-based proof, including a真正的 rootless container, --network none, and a check for no egress.
Agenthof does not promise outcomes: real models vary, and a run may skip a door, call twice, or take another path; the promise is narrower and more testable: no matter what the model does, it is governed and recorded in the ledger.
The Agent's own summary is not evidence, because it is written by an untrusted Agent; the evidence is the door events, written first-hand by Agenthof and the runtime. If the two conflict, the ledger decides. The ledger is tamper-evident detection, not immutability.
Agenthof's engine, Agent, demonstration, hermetic CI run, and honest limitations page are all in the Apache-2.0 repository.
All Facts (10)
Agenthof is an open-source governance plane licensed under Apache-2.0, whose core claim is that the Agent is never trusted, but every request must pass through a door, and the door authorizes, injects credentials, and writes the ledger.
50%UnverifiedAgenthof splits the system into two completely independent programs: agenthof is the governance engine, responsible for apply, run, audit, and investigate, never embedding the Agent and never deciding how the Agent thinks; the Agent is a separate program (a small LangChain Agent in the repository), agenthof calls it over a socket and drives it with the model door, tool door, execution door, and spawn door.
50%UnverifiedThe Agent runtime has no network, no keys of its own, and cannot directly call backend systems, and can only make requests to the doors; when it needs to operate on a system isolated per user, the gateway performs an RFC 8693 Token Exchange, exchanging the initiator's verified Token for a Token that acts on the upstream, and then calls the system as the initiator, with keys never entering the Agent process.
50%UnverifiedAfter a run ends, agenthof audit <run> prints that run's ledger in order, that is, the receipt, including the run ID, initiator, status, ledger integrity verification result, and records of each event (such as model, exec, tool, spawn, etc.).
50%UnverifiedIn Agenthof's demonstration, a real model is given the Agent's actual capabilities as tools and decides round by round what to call; when the Agent oversteps, what stops it is the door, not a script; model-driven operation does not require adding new door types.
50%UnverifiedThe Agentic loop means the model decides its next action each round based on the current context, the control flow is produced by the model, and the path is unpredictable; Agenthof governs by constraining the door of each call rather than constraining the model's thinking.
50%UnverifiedAgenthof's demonstration does not prove isolation: the isolation pod is a host process launched by a test double, and nothing in this run proves that the Agent cannot access the provider on its own; for this the project maintains a separate Podman-based proof, including a真正的 rootless container, --network none, and a check for no egress.
50%UnverifiedAgenthof does not promise outcomes: real models vary, and a run may skip a door, call twice, or take another path; the promise is narrower and more testable: no matter what the model does, it is governed and recorded in the ledger.
50%UnverifiedThe Agent's own summary is not evidence, because it is written by an untrusted Agent; the evidence is the door events, written first-hand by Agenthof and the runtime. If the two conflict, the ledger decides. The ledger is tamper-evident detection, not immutability.
50%UnverifiedAgenthof's engine, Agent, demonstration, hermetic CI run, and honest limitations page are all in the Apache-2.0 repository.
50%