Docker already shows a warning card that says Docker group grants root level to the user. You can only get away with this for so long, but as agents keep getting smarter, new ways of circumventing controls will be found. For now always seek to install rootless docker whenever possible
Wait, so the agent keeps state without the control plane? How do you handle conflicts if you toggle between local CLI and cloud management without split-brain?
Spot on, Yaron. Schematic validation (Protobuf) catches structural errors, but semantic aliasing (the 'rm -rf' vs 'rm -r -f' problem) is exactly why I developed the CAR (Canonical Action Representation) spec.
I actually published a 40-page paper (DOI: 10.5281/zenodo.18296731) that defines this exact 'Action Authorization Boundary.' It treats the LLM as an untrusted actor and enforces determinism at the execution gate.
Faramesh Core is the reference implementation of that paper. I’d love for you to check out the 'Execution Gate Flow' section. it would be a massive win to see a Faramesh-Cordum bridge that brings this level of semantic security to your orchestrator.
Hey @yaront111, Cordum looks like a solid piece of infrastructure especially the Safety Kernel and the NATS based dispatch.
My focus with Faramesh.dev is slightly upstream from the scheduler. I’m obsessed with the Canonicalization problem. Most schedulers take a JSON payload and check a policy, but LLMs often produce semantic tool calls that are messy or obfuscated.
I’m building CAR (Canonical Action Representation) to ensure that no matter how the LLM phrases the intent, the hash is identical. Are you guys handling the normalization of LLM outputs inside the Safety Kernel, or do you expect the agent to send perfectly formatted JSON every time?
We spent most of 2025 watching teams try to 'prompt' their way out of agentic hallucinations. It doesn't work. If you give an LLM-based agent access to a production database or a shell, you are always one 'ignore previous instructions' jailbreak away from a catastrophic incident.
We believe Faramesh is the first project to treat the 'Agent-to-System' bridge as a distributed systems problem rather than a prompting problem.
The hardest part to get right was the Deterministic Canonicalization. LLMs are inherently messy—one model might send {"power": 100.0} while another sends {"power": 100} for the same tool call. To build a reliable Action Authorization Boundary (AAB), we had to ensure that the semantic intent produces a stable, cryptographic hash every single time. Without this, you cannot have reliable RBAC, audit trails, or 'fail-closed' security for autonomous agents.
We’ve open-sourced the core logic today and would love for the community to tear apart our approach in canonicalization.py. We’re specifically interested in whether people think this architecture could eventually be standardized into a formal 'Agentic Firewall' protocol.
The problem with autonomous agents today isn't that they aren't "smart" enough; it’s that they are fundamentally stochastic, while our infrastructure (SQL, APIs, Shell) is deterministic. You are essentially giving a probabilistic model a direct line to your production environment and hoping "system prompts" act as security. As we found out in 2025, prompts are not a security layer. You cannot safely give a probabilistic model a "delete" key and hope the instructions hold.
We built Faramesh to bridge this gap. It is the first formalized Action Authorization Boundary (AAB) for the agentic web—an open-source, protocol-agnostic execution gate designed to sit between an agent’s reasoning engine and the target system.
In 2025, everyone focused on the "Brain" (the model). In 2026, the bottleneck is the "Nervous System" (execution control). The industry is shifting from Model-mania to Infrastructure-mania; we believe agents shouldn't be "trusted"—they should be governed.
How it works: Unlike existing guardrail libraries that use more LLMs to "check" the first LLM (adding more stochasticity), Faramesh introduces a hard, cryptographic gate. It intercepts agent intent, canonicalizes it into a deterministic byte-stream, and validates it against a strict, logic-based policy engine before any code is executed.
Key Technical Details:
- Deterministic Canonicalization: We found that slight variations in JSON or float representation break audit trails. Faramesh handles lexicographical sorting and float normalization (e.g., ensuring 1.0 and 1.00 produce identical bytes) so that identical intent produces identical hashes.
- The AAB Protocol: This defines what an agent is allowed to do across any medium. Whether targeting REST APIs, gRPC, or raw Shell, the control logic remains the same.
- Zero Trust Execution: The agent never touches the target system directly. It sends a "Proposed Action" to the gate. If the engine is confused or a policy is missing, it fails closed and the action is blocked.
- Cryptographic Hashing: Every authorized action is hashed, creating an immutable, replay-protected audit trail of agent intent.
- SDK-First Integration: We’ve released SDKs for Python and Node.js to make this a drop-in layer for existing LangChain/AutoGen stacks.
We’ve open-sourced the core engine and the SDKs. We’re particularly interested in feedback on our canonicalization logic and the policy engine’s performance overhead.