Show and tell: signed, one-time mediation for agent tool effects (not a Cedar/OPA competitor)

[Aliipou]

What this is

decision-os-min is a small Python execution-governance runtime for autonomous systems that act.

Cedar and OPA answer may this actor do this? They are more general IAM. This repo is a different product: bind the action, sign once, spend the capability once, run the effect only at a PEP, append a hash-chained audit. Cedar/OPA can sit in as a trusted PDP (grant/deny only). They cannot mint or execute.

Explainer (static, no PEP): https://ali-decision-os-min.vercel.app

Why it exists

Prompt rules and permission engines do not preserve human ownership of machine effects. Legitimacy (ownership/consent) is injected policy and DENY-only. Authority is a delegated, spendable capability. Ethics are not baked into the kernel.

This is not an AGI-safety proof, not a Cedar replacement, and not a claim of process-wide non-bypassability. Tests are evidence, not proofs. TM-A full remains PARTIAL.

What is actually enforced (in this reference)

• Signed decision bound to action content (confused-deputy defense)
• One-time token; durable spent-store on a shared volume
• Mandatory PEP; no effect without verify + unspent token
• Optional Hosted plane: untrusted agent sends Intent JSON only
• Optional Linux/Docker isolation profile for named TM-A slices

Docs: WHY · COMPARISON · THREAT MODELS

Install: pip install decision-os-min

If you work on agent tool authorization, MCP gateways, or Cedar/OPA as a PDP in front of effects, critique is welcome — especially failed attacks.

[Aliipou]

The goal is that this mint/execute split become a standard (other PEPs can implement it) and eventually infrastructure (keys, isolation, spend, review).

It is neither, today. The candidate profile is now written so the claim can be attacked:

https://github.com/Aliipou/decision-os-min/blob/main/docs/STANDARD_AND_INFRA.md

Cedar/OPA remain the policy standard. This profile is only the effect-mediation layer they do not specify. TM-A full stays PARTIAL until isolation residuals close.

[Aliipou]

Visibility wave (2026-08-23)

I submitted the project to on-topic curated lists (author disclosure + PolyForm-NC stated). I did not spray more random GitHub threads.

Lists (opened)

• [Submission]: decision-os-min systempromptio/awesome-ai-agent-governance#54
• Add decision-os-min to Open-Source Governance Toolkits systempromptio/awesome-ai-agent-governance#55
• Add decision-os-min to Other Usecases open-policy-agent/awesome-opa#86
• Add decision-os-min to Authorization and Policy authora-dev/awesome-agent-security#8
• Add decision-os-min to Agent Governance & Policy Enforcement CodeSigils/awesome-agent-trust#6
• Add decision-os-min to Agent Firewalls & Gateways ProjectRecon/awesome-ai-agents-security#99

Repo homepage is the explainer: https://ali-decision-os-min.vercel.app
Topics now include authorization, opa, cedar, mcp, pep, ed25519.

Paste-ready posts (accounts I cannot use from here)

Hacker News — Show HN

Title: Show HN: PEP that will not run an agent tool without a signed, one-time, action-bound grant

Body:

Cedar/OPA answer “may this actor do this?” That is necessary IAM. Autonomous systems that act still need a second artifact: a signed decision bound to the action content, a one-time capability, and a PEP that will not run the tool without both.

decision-os-min is a small Python reference for that split. Cedar/OPA can sit in as replaceable PDPs (grant/deny only). They do not mint. The agent never holds the signing key.

Not a Cedar competitor. Not an AGI-safety proof. Tests are evidence, not proofs. License is PolyForm Noncommercial 1.0.0.

https://github.com/Aliipou/decision-os-min
https://ali-decision-os-min.vercel.app
https://github.com/Aliipou/decision-os-min/blob/main/docs/WHY.md

Reddit (r/netsec, r/Python, r/LocalLLaMA — pick one; do not cross-post the same hour)

Title: Signed one-time PEP for agent tool effects (not another Cedar/OPA)

Use the same body as HN. Disclose you are the author.

LinkedIn / X / Bluesky

Shipped a small Python runtime for machines that act:

bind the action → sign once → spend the capability once → PEP runs the effect or nothing.

Cedar/OPA stay replaceable PDPs. They do not mint.
Not a standard. Not production-grade. Tests ≠ proofs.

github.com/Aliipou/decision-os-min

I will not post these for you — those sites need your login.

[Aliipou]

Pointer for people who arrived here for the PEP: the moral constitution is a different repo.

A machine that acts needs a yes/no on legitimacy before anyone asks authorization or preference.

Does this action violate legitimate property rights?

If that question is not asked, RLHF, a soft constitution, a risk score, or an IAM grant can all say yes to an illegitimate act.

We published the book and a sixteen-chapter edition for philosophers of AI and morals (CC BY 4.0):

• https://github.com/Aliipou/freedom-theory
• https://github.com/Aliipou/freedom-theory/blob/main/JUSTIFICATION.md
• https://github.com/Aliipou/freedom-theory/tree/main/for-philosophers
• Home thread: Theory of Freedom — a hard legitimacy floor for machines that act freedom-theory#1

Floor, not complete ethic: free will + property; A1–A7; consent cannot waive exit; no emergency override; justice only inside the legitimate set; contradiction clarifies ownership, it does not synthesize a permission. Gödel: consistent and incomplete. AI is the consistency test.

We do not claim every Western liberty theory is refuted, or that inputs match the world without attestation. Cedar/OPA/constitutions stay replaceable PDPs or preference layers. They do not replace a DENY-only legitimacy floor.

decision-os-min remains the authority + audit runtime. Ethics stay injected; FDK is DENY-only legitimacy. The book is not this package.

[Aliipou]

If this is useful, please star the public edition so other philosophers and labs can find it:

https://github.com/Aliipou/freedom-theory

Book + sixteen-chapter path + justification. CC BY 4.0. Not a Cedar/OPA competitor.

[Aliipou]

Looking for collaborators on decision-os-min — the authority + audit PEP, not a Cedar rewrite.

We need people who will try to mint or run an effect without a signed unspent grant; Hosted-plane / TM-A isolation (still PARTIAL); Cedar/OPA adapters that cannot mint.

Call + how to join: #3