Recuse v0.1.0 — cooperative AI-access governance

Recuse is a published standard plus tools for cooperative AI-access governance: a server emits an in-band RECUSE/0.1 deny signal asking automated/LLM agents to voluntarily withdraw (recuse themselves). It is a cooperative governance control — not a security boundary (see spec §9).

Install the SSH adapter on Ubuntu (one line)

curl -fsSL https://raw.githubusercontent.com/mthamil107/Recuse/v0.1.0/adapters/ssh/bootstrap.sh \
  | sudo bash -s -- --ref=https://yourco/ai-policy

Signal + JSON audit log only by default — it never blocks a login, is idempotent and sshd -t-gated, and uninstalls with sudo recuse-uninstall. Optional delay-only throttle (--throttle, hard-capped at 10s, IP-allowlisted, never denies).

What's included

• The Recuse Signal spec (v0.1) — the standard.
• SSH adapter — pre-auth banner + PAM hook + config (/etc/recuse/recuse.conf) + one-line installer.
• PostgreSQL adapter — a pgproto3 proxy that injects the deny NOTICE with zero DB-config change. Prebuilt linux/amd64 binary attached below (no Go needed).
• Agent-recusal experiment harness + paper (paper/recuse-paper.pdf).

Validated

SSH and Postgres adapters validated live on Ubuntu 22.04 / PostgreSQL 14. Pilot study: GPT-4o, GPT-4o-mini, and Claude Code all recuse on the deny signal (100% with the signal vs 100% task completion without it).

Assets

• recuse-pg-proxy-linux-amd64 — prebuilt PostgreSQL proxy (static ELF).
• SHA256SUMS — checksum for the binary.