What is TracePermit?
TracePermit is an open-source Agentic Visibility & Control (AVC) proof of concept. Its Java gateway attributes, classifies, authorizes, and records supported AI-agent tool actions before safe simulator execution. Real target adapters and production deployment are future work.
It allows organizations to answer the fundamental question:
"Who or what caused this action, what authority did it have, what exact operation was attempted, which policy applied, what was approved, and what outcome can be proven?"
The Problem: Why Agents Break Traditional Security
AI agents can propose multi-step tool calls and actions, including cloud operations. The enforcement question is what executable action crosses a controlled boundary—not whether the model's private reasoning was visible.
Existing security architectures fail to protect this layer:
- Prompt Guardrails are Text-Only: Tools like Llama Guard or NeMo look at input prompts or output text. They cannot inspect the structured parameters of an API call or verify whether an agent is drifting into unauthorized side effects.
- Traditional IAM is Too Coarse: Giving an AI agent an AWS IAM Role or an API key grants broad, standing privileges. Traditional IAM cannot answer: "Did a human approve this specific EC2 instance termination with these exact parameters?"
- Causal Lineage is Confused with Authority: A chain showing which agent called which does not by itself grant authority. The signed-workload POC independently verifies complete, narrowed delegation chains.
- Client Claims Cannot Be Trusted: Attackers can trick an agent into injecting headers (e.g., claiming to be an admin or claiming an action was pre-approved). TracePermit operates under complete mediation: never trust client-asserted security claims.
Core Pillars of TracePermit
┌─────────────────────────────────────────────────────────────────────────────┐
│ 1. Complete Mediation │
│ Every simulated side effect must pass through an enforcement point. │
│ No downstream action executes without prior normalization & evaluation. │
├─────────────────────────────────────────────────────────────────────────────┤
│ 2. Canonical Action Envelope & Deterministic Hashing │
│ Actions are normalized to `tracepermit-canonical-json-v1` and hashed. │
│ Policies evaluate stable semantic signals rather than raw prompt text. │
├─────────────────────────────────────────────────────────────────────────────┤
│ 3. Cryptographic Execution Permits │
│ Approved actions receive a single-use JWS permit cryptographically bound │
│ to the exact action hash, subject, target, and policy version. │
├─────────────────────────────────────────────────────────────────────────────┤
│ 4. Independent Endpoint Process Attestation │
│ An OS process observer independently inspects parent process stability, │
│ executable hash, and TTY state, signing an Ed25519 attestation proof. │
├─────────────────────────────────────────────────────────────────────────────┤
│ 5. Safe Simulation & Reconciliation │
│ Stateful AWS/Jira simulators test side-effect behavior before any real │
│ credentials are introduced. Ambiguous outcomes enter reconciliation. │
└─────────────────────────────────────────────────────────────────────────────┘How TracePermit Fits in Your Stack
In the current POC, TracePermit sits between supported client origins and simulated AWS/Jira tools. A real enterprise deployment would additionally need controlled target credentials and anti-bypass egress:
[ AI Agent / Developer CLI ]
│
▼
[ Model / Orchestrator ]
│ (Proposes structured tool call)
▼
┌──────────────────────────────────────┐
│ TracePermit Gateway │
│ 1. Authenticate & Verify Attestation│
│ 2. Normalize to Canonical JSON │
│ 3. Evaluate Policy & Arguments │
│ 4. Mint Cryptographic Permit │
└──────────────────────────────────────┘
│ (Permit + Normalized Action)
▼
[ Safe AWS/Jira Simulator ]Next Steps
- Local POC quickstart: Build and run the Java gateway, React console, and simulator scenarios from source.
- The Security Invariant: Deep dive into the formal trust guarantees.
- End-to-End Architecture: Explore the complete pipeline from ingress to execution.