{"slug": "show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents", "title": "Show HN: Kepil – passport, mandate and tamper-evident journal for AI agents", "summary": "Developer oleg-vdv released Kepil, an open-source accountability layer for AI agents that provides an immutable passport, a machine-readable mandate, a fail-closed action gate, a hash-chained append-only journal, and an undo mechanism, installable via \"pip install kepil\". Kepil cites Cloud Security Alliance and State of AI Agent Security 2026 figures showing 53% of organisations have had an AI agent exceed its intended permissions, 48% of production agents run with no monitoring, and only 22% treat an agent as an entity with its own identity. The tool ships an MCP server with seven tools but deliberately omits a confirmation tool so that no model can approve an irreversible action, and its JSON API stays disabled until a KEPIL_API_TOKEN is set.", "body_md": "**Accountability layer for AI agents.** Give every agent a passport, put every\naction through one gate, and keep a log that cannot be rewritten afterwards.\n\n53% of organisations have had an AI agent exceed its intended permissions. 48% of agents in production run with no monitoring at all. Only 22% treat an agent as an entity with its own identity. — Cloud Security Alliance and State of AI Agent Security, 2026\n\nKepil is what the other 78% are missing: identity, mandate, enforcement,\nevidence — and the part nobody else does, **undo**.\n\n```\npip install kepil\npython -m kepil.admin        # http://localhost:7317\n```\n\nРусская версия: [README.ru.md](/oleg-vdv/kepil/blob/main/README.ru.md)\n\n**Passport.** Every agent version gets an immutable card: who built it, who runs\nit, what it does, what it will *never* do, its risk class, its autonomy class,\nits limits, and when its risks are due for review. A new version is a new card;\nthe old one is kept forever.\n\n**Mandate.** A machine-readable power of attorney for one job: allowed actions,\nallowed systems, spending limits, a validity window, and which action types must\nbe confirmed by a human. Anything not explicitly allowed is refused.\n\n**Gate.** The single point through which an agent touches the outside world.\nEvery action is checked against the mandate *before* a model is even called.\nFail-closed: any error inside the check means refusal, never a pass.\n\n**Journal.** Append-only JSONL where every record carries the hash of the one\nbefore it. Editing or deleting a record is detectable — by anyone, using an\nindependent implementation:\n\n```\nnpx proofbyte-agent-trace verify data/journal.jsonl\n```\n\n**Undo.** The journal is a graph of actions, and every profession declares its\ncompensating action. Kepil walks that graph backwards and stops honestly at the\nfirst step that cannot be undone. Agent platforms record what happened; this one\nputs it back.\n\n**Confirmations on your phone.** Irreversible actions arrive in Telegram with\ntwo buttons — approve or return — so being accountable does not mean sitting at\na laptop.\n\nKepil ships an MCP server, so an editor, an assistant or another agent can work through it — and every action still passes the same gate into the same journal.\n\n```\n{\n  \"mcpServers\": {\n    \"kepil\": { \"command\": \"python\", \"args\": [\"-m\", \"kepil.mcp\"] }\n  }\n}\n```\n\nSeven tools: list professions, create an order, run a step, read order status, see what is waiting for a human, verify the journal, read an agent passport.\n\n**One tool is deliberately missing: confirmation.** If a model could approve an\nirreversible action, the human would drop out of the chain and the whole design\nwould be pointless. The confirmation card goes to a person — in the panel or in\nTelegram — and no MCP client can press it. A test enforces this.\n\nKepil has a small JSON API, so an n8n workflow, a Make scenario or your own script can ask permission before acting:\n\n```\ncurl -X POST http://localhost:7317/api/check   -H \"Authorization: Bearer $KEPIL_API_TOKEN\"   -H \"Content-Type: application/json\"   -d '{\"order_id\":\"ord-0042\",\"action\":\"send:message\",\"system\":\"whatsapp.local\"}'\n{ \"decision\": \"await_human\", \"allowed\": false, \"needs_human\": true,\n  \"reason\": \"необратимое действие: требуется подтверждение человека\" }\n```\n\nThe answer is recorded in the journal, so later you can show on what grounds the\nautomation did — or did not do — something. For n8n there is a ready node:\n[n8n-nodes-kepil](https://github.com/oleg-vdv/n8n-nodes-kepil).\n\n**The API stays off until you set a token** (panel → Settings, or\n`KEPIL_API_TOKEN`). A panel bound to localhost is protected by the binding; a\nprogrammatic interface is not, so it is disabled by default.\n\n`AgentPassport` refuses to be constructed with the autonomy class where a human\ncan no longer cancel a decision. That is a deliberate architectural limit rather\nthan a missing feature — see\n[ADR-0002](/oleg-vdv/kepil/blob/main/docs/decisions/ADR-0002-medium-autonomy.md). The gate enforces the\nsame rule regardless of what a profession definition claims.\n\nAn agent's job is a JSON description: ordered steps, boundaries, limits, irreversible action patterns, rollback rules. Adding a new kind of work means adding a file — or filling in a form in the panel. The dangerous parts stay in code and under test.\n\nFive ship with the project: inbound leads, process automation, bookkeeping documents, AI-adoption audit, public-procurement packages.\n\nAn order's journal is a sequence of actions and every profession declares the\ncompensating action for each, so the panel can walk it backwards: pick a window,\nand the pass runs from the last action towards earlier ones, stopping at the\nfirst one that cannot be undone. What will happen is shown **before** the button\nis pressed, naming the step where the pass will stop — an undo promise that\nquietly fails is worse than no undo at all. The result is recorded as an\noperator's decision, which is why neither the MCP server nor the JSON API can\nroll anything back: an agent undoing its own actions would be signing in\nsomebody else's name.\n\n`python -m kepil.admin` opens an operator console: orders, professions, agent\npassports, a meter (actions, tokens, cost, human time replaced), the compliance\ngenerator, the journal with chain verification and anchoring, and settings.\n\nState is plain JSON files under `KEPIL_DATA` (default `./data`). No database:\nyou can open them, read them, and attach them to a dispute.\n\nDocumentation requirements differ by country and change faster than code, so the\ntexts live outside the engine. The neutral pack shipped here follows\ninternational practice (ISO/IEC 42001, record-keeping in the spirit of the EU AI\nAct). Jurisdiction packs — for example Kazakhstan's AI Law No. 230-VIII with\norder No. 95/НҚ — are dropped into `$KEPIL_DATA/packs` as files.\n\n- **Zero dependencies.** The core runs on the Python 3.11+ standard library, and\nCI fails the build if a third-party import appears. That keeps Kepil\ninstallable inside an air-gapped perimeter, and keeps the supply-chain attack\nsurface of a tool that sees every action at zero.\n- **Values never enter the journal** — only types, counts and hashes.\n- **The verifier is a separate implementation in another language.** Proof that\nonly its own author can check is not proof.\n\n| Project | Role | \n|---|---|\n| [agent-trace](https://github.com/oleg-vdv/agent-trace) | Independent journal verification and evidence packs (MIT) | \n| [AI-Gateway](https://github.com/oleg-vdv/AI-Gateway) | PII and secret masking between your apps and external models | \n| [AutoGov](https://github.com/oleg-vdv/AutoGov) | Discovery of shadow automations and the credentials they can reach | \n\nAlpha, 115 tests. Interfaces may still change. Nothing here is a legal opinion: before relying on generated documents, have them reviewed by a lawyer in your jurisdiction.\n\nAGPL-3.0-or-later. Running a network service built on Kepil obliges you to\nrelease your own source under the same terms — or to take a commercial licence.\nSee [NOTICE.md](/oleg-vdv/kepil/blob/main/NOTICE.md).", "url": "https://wpnews.pro/news/show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents", "canonical_source": "https://github.com/oleg-vdv/kepil", "published_at": "2026-09-14 05:28:36+00:00", "updated_at": "2026-09-14 05:57:28.537188+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "ai-policy"], "entities": ["Kepil", "oleg-vdv", "Cloud Security Alliance", "State of AI Agent Security", "n8n-nodes-kepil", "proofbyte-agent-trace", "Telegram", "AgentPassport"], "alternates": {"html": "https://wpnews.pro/news/show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents", "markdown": "https://wpnews.pro/news/show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents.md", "text": "https://wpnews.pro/news/show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-kepil-passport-mandate-and-tamper-evident-journal-for-ai-agents.jsonld"}}