intent-plane: Gate and Audit Irreversible Agent Actions

Overview

intent-plane is a Go-based authorization gate for AI agents that can move money, submit reports, or trigger other irreversible actions. It addresses the risk of relying on an agent's prompt or trusting the gate's own account of what happened: agents must declare an action, and the gate makes a deterministic decision against a human-signed policy before the action runs.

Each decision is written to a durable feed that independent Go and Python verifier packages can recompute without importing or trusting the gate. The repository also provides Go and Python declarant SDKs, plus optional LangChain and MCP adapters for placing the gate at the tool-call boundary.

Key Features

• Fails closed when a policy is missing, unsigned, revoked, too thin to evaluate, or otherwise unevaluable.
• Requires declared intent before a tool body or other consequence runs; refusals prevent the action from reaching the tool.
• Derives idempotency keys from canonicalized action identity to refuse duplicate actions across retries and replicas.
• Records decisions in an append-only feed with trajectory hashes, designed for later independent recomputation.
• Includes Go and Python verifier implementations and a CLI for checking feed records against frozen fixtures.
• Offers Go and Python declarant SDKs, with optional LangChain and MCP integrations, including a proxy for tools whose server the operator does not control.
• Uses signed, content-addressed policy artifacts, with a separate authoring and attester boundary described in the repository.

Use Cases

• A fintech or treasury platform can gate agent-initiated payments before execution and give audit teams records they can independently verify.
• A compliance team can require authorization before submitting regulatory reports, including refusing repeat submissions for the same stated identity.
• An agent platform team can add a shared gate at its LangChain or MCP integration point so multiple agents inherit the same decision boundary.
• An operator can front an MCP server it does not own, refusing unauthorized calls before they reach that server.

Getting Started

Build and test the Go tree with:

go build ./... && go vet ./... && go test ./... -count=1

See the README and docs/integration.md for SDK and adapter setup, and docs/assurance.md for the status of the security and audit claims.

License in Plain Words

No standard license was detected. Without a license, the default copyright rules apply: you may read the code, but not reuse it. Check the repository or ask the authors.

Alternatives

• bernstein: Bernstein governs agent workflows through a Python scheduler, while intent-plane gates individual irreversible actions against signed policy.

Considerations

The project is new and changing quickly. Recent commits indicate active development, but the repository's measured activity shows one contributor responsible for most of the work, no releases in the past year, and no recent issue closures or merged pull requests. That leaves limited evidence of long-term maintenance or outside review.

The README says key authority is still test-grade, while workload identity and record signing are staged rather than built. The verifier can establish that records are self-consistent, but the project does not claim this proves they were never rewritten. The examiner's kit must be built and handed to auditors by the operator; it is not published as a release artifact, and its integrity process uses checksums rather than signatures. The Python tree is vendored rather than distributed through PyPI. No license is listed in the supplied repository data, so teams should verify licensing before adoption.