The problem
Agents have the keys. Logs can't prove who authorized what.
Teams are handing AI agents real write access: agents that merge code, change infrastructure, edit tickets, and touch customer data. When an agent does the wrong thing, what’s left is scattered logs and third-party chat histories — editable, incomplete, and unable to prove that an action was authorized by an unexpired policy. Incident reconstruction is slow and unreliable.
The solution
A gateway that fails closed.
The Membrane sits directly in front of your agents. It requires a live, signed authorization for every model and tool call, records each action in a tamper-evident, hash-linked receipt chain, and blocks or severs the agent the moment the chain breaks. Approved actions are provable; unauthorized ones never hit production.
Who it’s for
Sovereigns. Nation-states. Enterprise.
One product — a fail-closed authorization gateway for AI agents with production or operational write access — sold to three customer classes: sovereigns, nation-states, and enterprise. Self-host the gate, hold your own keys, and prove every agent action with live signed scopes and tamper-evident receipts. High-assurance and mil/gov postures sit with sovereign and nation-state operators who need attested actions and fail-closed continuity.
Why it's different
Enforce — don’t just observe or filter.
It enforces, it doesn't just watch.
Observability tools explain what an agent did after the fact. Prompt filters rewrite text. The Membrane is an inline control point that refuses unauthorized actions before they reach production.
Authorization is bound to the action, not the prompt.
Every action carries a signed policy naming the exact model, tools, and scope, linked into a tamper-evident receipt chain. A silent model or tool swap breaks the chain and is blocked.
Incident reconstruction in minutes.
Because approvals and actions are hash-linked, you can trace any action to its authorizing policy and issuer — and hand auditors a signed evidence pack. No dependence on a provider's mutable logs.
The demo, in six steps
Grant scope. Allow. Block. Sever. Reconstruct. Prove.
-
Grant scope
An operator issues a 15-minute authorization for a support agent: one model, tools limited to jira.comment and slack.post, bound to one task.
-
Approved action
The agent posts a ticket comment. A green, linked receipt shows policy → model → tool, all matching and chained to the prior receipt.
-
Blocked swap
The agent reaches for a different model, or for github.merge — outside the authorization. The Membrane blocks it; a red receipt shows exactly why.
-
Expiry / sever
The authorization expires, or security hits sever. The next tool call fails closed; an alert lands in the incident channel.
-
Reconstruct
Open the timeline, click any action, and see the model, context scope, policy, and issuer behind it — no log spelunking.
-
Export evidence
One click produces a signed evidence pack. Verify the hash chain offline in seconds. SIEM-ready JSON Lines or OCSF-inspired export for existing SOC tooling.
Try the isolated public sandbox, or run the same interactive walkthrough locally with one command.
Run it locally
One command. No relay, no secrets, no paid APIs.
The local dashboard walks the full fail-closed narrative — issue, allow, block, sever, evidence — backed by real Membrane gate checks and CP receipt chaining, using ephemeral keys and an in-memory bus. Receipts also export as JSON Lines or OCSF-inspired JSON for an existing SIEM.
# clone the repo
git clone https://github.com/Z0rlord/the-membrane.git
cd the-membrane
# launch the local Membrane demo dashboard
cargo run -p membrane-cli -- demoThen open http://127.0.0.1:8790/