An enforcement layer for AI coding agents

You let an AI agent into your code. Can you prove it did only what you allowed?

The owner signs a permission, the Linux kernel holds the boundary, and every run closes into a passport that anyone can verify offline — trusting neither us nor the agent.

The problem

“What else could it have touched?”

AI agents already write code and edit documents. But when someone asks that question, today's only answer is “trust the agent's logs.” For a client, an auditor, or a court — that is not an answer.

The mechanism / three entries

Permission

The owner signs a grant: these files, this task, this time window. Nothing else is on the table.

Boundary

The Linux kernel refuses every write outside the grant while the agent works. Not a request to the agent — a refusal by the operating system.

Passport

The run closes into a signed record of what was permitted and what happened, byte for byte. Checked in thirty seconds, offline, on your machine.

The exhibit / touch it yourself

One byte, flipped.

A real run passport and a copy of it with exactly one byte changed are published. Flip between them and watch the verdict turn.

A / THE PASSPORT B / SAME BYTES, ONE BYTE CHANGED

VERDICT / PASS

examples/verified/run-passport.json PUBLISHED IN THE REPOSITORY

{
  ...
  "run_id": "deedseal-public-demonstration-v1.0",
  "owner_authorization": { "signature": "..." },
  ...
}

VERDICT / BLOCK

examples/verified/run-passport.tampered.json PUBLISHED IN THE REPOSITORY

{
  ...
  "run_id": "deedseal-public-demonstration-v2.0",
                                            ^ 1 -> 2
  "owner_authorization": { "signature": "..." },
  ...
}

Both files sit in the public repository exactly as excerpted above. The verifier is one Python file, standard library only, no network — you can run the same check offline, on your machine.

Both checks, against the two published files

$ python3 tools/verify_run_passport.py examples/verified/run-passport.json
RUN_PASSPORT_VERDICT: PASS

$ python3 tools/verify_run_passport.py examples/verified/run-passport.tampered.json
RUN_PASSPORT_VERDICT: BLOCK block_owner_authorization_signature_invalid

Read the walkthrough Browse the record on GitHub

Who this is for

Engineers

who let agents change real repositories and want the allowed scope enforced and recorded — not assumed.

Reviewers and auditors

handed machine-made changes, who need “what else could it have touched?” answered without trusting the agent's account.

Anyone who must stand behind AI-made work

before a client, an auditor, or a court.

Honest status / dated

We publish the record, not promises.

Deedseal is in active development. The core is demonstrated publicly and verifiably — one supervised run is published with its passport, its tampered twin, and the verifier, re-proved on three operating systems on every change. The product is not for sale yet. Current state, dated: status.