OVARA · Runtime Trust & Control Infrastructure
Check identity and authority at the moment of action.
Runtime trust and control infrastructure for autonomous systems and agents.
A single-binary Go gateway that intercepts machine-driven actions, evaluates policy, verifies machine identity, and records a receipt for every decision, at the moment an agent tries to act.
Builds from source with Go into a single gateway binary. Install guide.
Actions from an agent arrive at one gate and leave as allow, escalate or deny. A conceptual picture, not output from a deployment.
01
Checked at the moment of action.
An agent asks before it acts. The gateway answers allow, deny, or escalate, and the action runs, stops, or waits for a person.
The log beside the request is illustrative, not output from a real deployment.
Runtime check · examplePOST /v1/runtime/check
- Action type
- shell
- Resource
- git push origin main
- Environment
- production
- Agent identity
- agent-7c9a1b…
- Capability lease
- lease-a3f7…
- Decision
- escalate
- Requires approval
- Yes
- Trust score
- 0.5
- Receipt
- stub_9f8e2d…
Decision logIllustrative
| Time | Agent | Action type | Resource | Decision |
|---|---|---|---|---|
| 14:02:07.118 | agent-7c9a1b | shell | ls -la ./build | allow |
| 14:02:07.342 | agent-7c9a1b | git fetch | origin | allow |
| 14:02:08.004 | agent-7c9a1b | shell | git push origin main | escalate |
| 14:02:09.551 | agt_001 | git force_push | origin main | deny |
| 14:02:10.209 | agt_001 | exec | curl … | sh | deny |
02
The missing layer.
OVARA is an actively developed runtime trust and control layer for autonomous systems. It sits on the execution path between an autonomous agent and a consequential action (shell, Git, GitHub, CI/CD), providing a control layer to constrain, explain, and revoke machine authority at the moment of action. Built around five primitives - AgentIdentity, CapabilityLease, DelegationChain, TrustContext, and ExecutionReceipt - OVARA currently has 2 interceptor implementations wired (shell and Git). The evaluator recognizes 14 action types. GitHub and CI surfaces are planned. The runtime is functional and under active development toward a stable release.
Cloud IAM, API gateways, and workload identity were built for humans and deterministic microservices: predictable control flow, long-lived credentials, and strictly bounded automation.
Autonomous systems break that threat model. Agents make decisions at runtime, use tools adaptively, operate under delegated authority, and drift over long horizons. Existing infrastructure can authenticate an agent, but it cannot constrain, explain, or revoke it at the moment it executes a destructive action.
What is missing today
- 2.1No verifiable identity. Any process can claim to be an agent. Without cryptographic machine identity, impersonation is trivial.
- 2.2Static keys never expire. A leaked API key works forever: there is no lease, no scope, no blast-radius control.
- 2.3No record of what ran. After an incident, nobody can prove which action executed and under whose authority.
Runtime path · schematic
- From
- AI agent / workflow
- Interceptor
- OVARA runtime interceptor: identity verification (ed25519), capability lease validation, policy engine, risk and trust evaluation
- Decision
- allow → execution sandbox / target system; escalate → human approval routing; deny → blocked with reason codes, nothing runs
- Observe
- Observe pipeline (OTLP / NATS) → execution receipt and audit trail
OVARA sits on the execution path between an autonomous agent and a consequential action: shell, Git, GitHub, CI/CD.
03
Intercept. Check. Evaluate. Decide.
Endpoints, fields, and decision values verified against the OVARA gateway source. Then a receipt, every time.
- 3.1Intercept. 2 interceptor implementations currently wired (shell, Git). The evaluator recognizes 14 action types; GitHub and CI/CD surfaces remain planned.
- 3.2Check. POST /v1/runtime/check with action_type, resource, environment, plus optional agent_identity and capability_lease.
- 3.3Evaluate. Policy evaluation, ed25519 identity verification, lease validation, and trust scoring in a single pass.
- 3.4Decide. The evaluator returns one of three decisions: allow, escalate or deny.
- 3.5Receipt. Every decision returns a receipt_stub and appends to an HMAC-SHA256-signed execution log.
Decisions
| Decision | What happens |
|---|---|
| allow | The interceptor executes the action. |
| escalate | Routes to a human via /v1/approval/create → approve → resume. |
| deny | Blocked with reason codes. Nothing runs. |
Request fields/v1/runtime/check
| Field | Required |
|---|---|
| Action type | Required |
| Resource | Required |
| Environment | Required |
| Agent identity | Optional |
| Capability lease | Optional |
04
Five primitives.
Every intercepted action passes through five cryptographic and logical primitives before it reaches the host system.
- 4.1
Agent identity
AgentIdentityed25519 keypairs. Verifies which machine, container, or sub-agent is requesting the action, so a process cannot simply claim to be an agent.In V1 the runtime check validates identity strings; signature verification is not yet enforced.
- 4.2
Capability lease
CapabilityLeaseStatic API keys are dangerous. OVARA issues time-bound, scope-limited leases that automatically expire, minimising the blast radius of a compromised agent.
- 4.3
Delegation chain
DelegationChainCryptographic proof of inheritance. Tracks which parent agent spawned which sub-agent, keeping provenance across autonomous swarms.
- 4.4
Trust context
TrustContextDynamic scoring engine. Computes sliding-window drift analysis and exponentially degrades trust if environmental anomalies or policy violations are detected.
- 4.5
Execution receipt
ExecutionReceiptA deterministic, HMAC-SHA256 hashed log of what ran, when it ran, and under whose authority.
05
Two wired. Two planned.
2 of 14 action types have interceptor implementations. GitHub and CI/CD surfaces are planned, not implemented.
| Interceptor | State |
|---|---|
| Shell | Wired |
| Git | Wired |
| GitHub | Planned |
| CI/CD | Planned |
The 14 action types the evaluator recognizes14
| Surface | Count | Action types |
|---|---|---|
| Process | 2 | shell, exec |
| Git | 5 | push, pull, fetch, checkout, force_push |
| GitHub | 4 | push, pr, merge, delete_branch |
| CI | 3 | deploy, build_trigger, approval |
As listed in the OVARA changelog. Recognized by the evaluator is not the same as intercepted: only the shell and Git interceptors are wired.
Integrations
- CrewAI
- OpenAI Agents
- LangChain
- MCP
- Browser Automation
- Python SDK
Use cases
- 5.1Block or approve AI-driven shell commands and infrastructure changes
- 5.2Enforce least-privilege capability leases across agent fleets
- 5.3Detect anomalous behavior with sliding-window drift analysis
- 5.4Generate cryptographic receipts for audit and forensics
06
Trust, receipts, hardening.
What the gateway keeps track of after the decision.
Trust degradation and drift detection
The trust context computes a sliding-window drift analysis over an agent's actions and degrades trust exponentially when environmental anomalies or policy violations are detected.
Use it to detect anomalous behaviour, and to enforce least-privilege capability leases across agent fleets.
Execution receipts
HMAC-SHA256 deterministic execution receipts: every decision returns a receipt_stub and appends to a signed execution log, for audit and forensics.
The operator must configure persistent receipt signing keys.
Hardening artifacts
| Artifact | Kind |
|---|---|
| AppArmor | profile |
| eBPF | syscall interceptor |
| Seccomp | syscall allowlist |
| Terraform / K8s | manifests |
Included in the repository but not automatically applied, and not loaded at runtime.
07
Sub-10 µs decisions, in process.
In-process Go microbenchmarks. Not end-to-end, not HTTP latency, not production throughput.
Fast enough for inline interception in agent workflows. Every decision runs identity verification, lease validation, policy evaluation, and trust scoring in microseconds.
- Type
- Synthetic microbenchmark - in-process
- Source
- runtime/gateway/internal/handlers/benchmark_test.go
- Excludes
- HTTP, network, persistence, receipt signing.
To reproduce, run the Go benchmarks in the gateway's handlers package; the steps are in the repository benchmark docs.
Policy evaluation microbenchmarksns/op · Apple M4
- Policy-only decision5,374 ns
- Decision with identity6,126 ns
- Decision with anomaly6,210 ns
- Full identity + lease decision7,669 ns
- HMAC-SHA256 sign598 ns
- HMAC-SHA256 verify614 ns
HTTP load test
Preliminary- Requests/sec
- ~4,010
- Errors
- ~19.76%
- p50
- ~3 ms
- p99
- ~98 ms
In the current HTTP load test, approximately 4,010 requests/sec were observed, with approximately 19.76% errors under the tested workload.
This result should not be interpreted as a production throughput guarantee. The error rate indicates tuning is needed.
- Type
- End-to-end HTTP load test
- Source
- runtime/gateway/tests/load/load_test.go
To reproduce, run the gateway's load test suite; the steps are in the repository benchmark docs.
No published reproducibility artifact (hardware spec, pinned config, raw output). Not independently reproduced. The sub-10 µs / 1.2 M/s numbers are in-process microbenchmarks, not end-to-end throughput. Benchmarks and reproducibility notes.
08
Under construction.
OVARA is in active development toward a V1.0.0 release. The gateway compiles to a single, static Go binary. Follow the repository for release updates.
Build from sourceGo
- Source
- SidianLabs/OVARA on GitHub
- Build
- Compile the gateway in runtime/gateway into the ovara-gateway binary.
- Run
- Start the binary; the runtime check API listens on localhost:8080.
- Steps
- Install guide
Runtime check API, live todaydev
- Action type
- shell
- Resource
- shell:git push origin main
- Environment
- dev
- Decision
- escalate
- Requires approval
- Yes
- Trust score
- 0.5
- Receipt
- Receipt stub returned
09
Scope and non-guarantees.
OVARA controls actions that pass through it. It says nothing about actions that do not.
- Through the gateway
- Checked, decided and receipted.
- Around the gateway
- Actions that bypass the gateway are not controlled.
What it does
- 9.1.1Single-binary Go gateway that intercepts machine-driven actions and evaluates allow/deny/escalate decisions.
- 9.1.2ed25519 machine identity and capability leases with scope and expiry.
- 9.1.3Trust scoring with sliding-window drift detection.
- 9.1.4HMAC-SHA256 execution receipts for every decision.
- 9.1.52 interceptor implementations wired (shell, Git); evaluator recognizes 14 action types.
What has been demonstrated
- 9.2.1Gateway compiles and runs; HTTP endpoint is functional.
- 9.2.2In-process microbenchmarks for policy evaluation.
- 9.2.32 of 14 action types have interceptor implementations (shell, Git); GitHub and CI/CD surfaces are planned.
What assumptions are required
- 9.3.1Actions must pass through the gateway. Bypassed actions are not controlled.
- 9.3.2Hardening artifacts (AppArmor, eBPF, Seccomp) are included but not automatically applied.
- 9.3.3Operator must configure persistent receipt signing keys.
What it does not guarantee
- 9.4.1That a model is aligned or will only request safe actions.
- 9.4.2Cryptographic signature verification is not yet enforced in the V1 runtime check.
- 9.4.3GitHub and CI/CD execution surfaces are planned, not implemented.
- 9.4.4The sub-10 µs / 1.2 M/s numbers are in-process microbenchmarks, not end-to-end throughput.
- 9.4.5Actions that bypass the gateway are not controlled.