# Can an AI agent still act after the operator has stopped its authority?

> Source: <https://github.com/GlobalSushrut/connector-oss>
> Published: 2026-10-06 16:09:39+00:00

**Control what AI agents can do—not only what they can say.**

[Website](https://cnktros.com) ·
  [Quick start](#quick-start) ·
  [Architecture](#architecture) ·
  [Security](https://github.com/GlobalSushrut/connector-oss/blob/main/oss/SECURITY.md)

Connector is an open-source control plane for AI agents that take real actions. It gives every agent an identity, explicit authority, per-action admission, runtime enforcement, operator stop controls, and an evidence trail.

Use your existing agent or assemble one in Connector. Before it sends a request, changes data, calls a tool, spends money, or contacts another agent, Connector decides whether that specific action may proceed.

Agent frameworks help agents reason and use tools. API gateways route traffic. Policy engines evaluate rules. Observability systems record events. None of these alone answers the whole operational question:

**Should this agent be allowed to perform this action, in this situation,
right now—and can an operator stop the next action?**

Connector joins that decision to identity, grants, runtime enforcement, and the resulting receipt.

| Without Connector | With Connector | 
|---|---|
| A tool credential often authorizes the whole process | Authority is scoped to the agent and action | 
| Instructions and permissions are mixed in prompts | Knowledge, directives, memory, and authority remain separate | 
| Approval may happen outside the execution record | Ask stays open until an operator decides it | 
| Logs explain activity after the fact | Admission and observed consequence share an evidence trail | 
| Stopping depends on model cooperation | **Cease** fences the generation and stops future admission | 
| Each backend has a separate operator workflow | Connector presents one workspace and manages the backends | 

Connector is for teams whose agents can affect real systems:

- platform teams operating internal or customer-facing agents;
- AI product teams adding tool use, MCP, A2A, browser, or API access;
- security and governance teams that need explicit authority and evidence;
- operators who need to pause or cease an agent without waiting for the model.

If an agent only produces text in a disposable sandbox, Connector may be more infrastructure than you need.

```
git clone https://github.com/GlobalSushrut/connector-oss.git
cd connector-oss
./up.sh
```

Open [http://127.0.0.1:9091/](http://127.0.0.1:9091/) and choose **Open on this machine**.
The local development token stays on your computer.

Then:

1. Open **Run → Demo** to see the governed action path.
2. Use **Bring your agent** to connect an existing agent.
3. Resolve actions waiting for a person in **Approve** .
4. Resolve TraceTramp runtime holds in **Fix** .
5. Inspect decisions and receipts in **Watch** .

- Linux
- Docker
- Rust
- Node.js
- [Trunk](https://trunkrs.dev/) and the WASM target:`rustup target add wasm32-unknown-unknown`

A smaller library server without the operator UI is documented in
[docs/quickstart.md](https://github.com/GlobalSushrut/connector-oss/blob/main/oss/docs/quickstart.md).

- **Governed workspace:** principal, purpose, presence, knowledge, directives,
authority, and situation stay distinct.
- **Per-action admission:** PATE returns Proceed, Ask, Defer, Quarantine, or
Block for a proposed effect.
- **Runtime enforcement:** a PATE permit does not bypass downstream policy or
isolation.
- **Operator control:** pause, stop, and Cease do not depend on model agreement.
- **Memory with provenance:** memory is stored as a MemPacket, separate from
traces and instructions.
- **Evidence:** receipts connect admission, execution, and observed consequence.
- **Agent-to-agent control:** different addresses can carry different grants and
situation ranges without granting the entire swarm.
- **One operator surface:** Connector manages the supporting identity,
enforcement, and evidence systems.

The action path is:

```
agent → proposed effect → PATE admission → runtime enforcement
      → external effect → receipt and observed consequence
```

The seven workspace dimensions describe how an agent is governed; they are not the seven external backends. PATE is the admission authority. A permit can still be denied at runtime. Cease fences the current generation, voids its context, and stops future admission.

`./up.sh` downloads pinned components, starts them with local defaults, and keeps
their operation behind Connector.

| Role | Components | 
|---|---|
| Identity | Keycloak, SPIFFE/SPIRE | 
| Enforcement | NVIDIA OpenShell, OPA/Rego, Firecracker | 
| Evidence | OpenTelemetry, Sigstore cosign | 
| Traffic-plane target | agentgateway for LLM, MCP, A2A, HTTP, and gRPC | 

Connector also supports MCP, A2A, and OpenAI-compatible agent interfaces. Pasting an address never creates a grant.

The workspace, PATE admission, receipts, Cease, TraceTramp, WitnessCtl, and seven-backend boot path are present.

Important limits:

- Firecracker boot currently downloads the binary and jailer; it does not create a microVM kernel or root filesystem.
- The agentgateway image starts, but end-to-end forwarding has not been proven and remains denied.
- Downloading or starting a backend does not prove that every admitted effect passed through it.
- Backend integrations are still partial.

This repository does not claim production readiness, security, correctness, safety, or compliance.

Read [CONTRIBUTING.md](https://github.com/GlobalSushrut/connector-oss/blob/main/oss/CONTRIBUTING.md) before opening a pull request.

Report exploitable findings privately through [SECURITY.md](https://github.com/GlobalSushrut/connector-oss/blob/main/oss/SECURITY.md).

Libraries under `oss/` use the [Apache License 2.0](https://github.com/GlobalSushrut/connector-oss/blob/main/oss/LICENSE). The node under
`platform/` uses the [Business Source License 1.1](https://github.com/GlobalSushrut/connector-oss/blob/main/platform/LICENSE).