Give agents more authority. Keep their blast radius bounded.
Clared is a stateful execution boundary between AI agents and the systems they act on. It stages mutations, returns required corrections to the agent, and releases effects only when the run is valid.
The agent can do the work. You still cannot safely let it.
Most controls approve one request at a time. The real risk accumulates across the entire run.
Useful access becomes broad access
Once credentials reach the model runtime, one wrong branch can affect any reachable customer, account, or production resource.
Safe calls can form an unsafe run
Each call looks valid in isolation; the sequence breaches budgets, skips state transitions, or acts on stale business state.
Real systems do not roll back together
A payment, a database write, and a message settle differently. A late failure leaves earlier effects committed, forcing manual repair.
Refund order #1042 and notify the customer.
A refund without its matching ledger entry would leave the books wrong. No single call looks unsafe; the sequence does.
Settlement stays blocked while an obligation is open. Obligations are authenticated run state, never prompt text, delivered through the ordinary tool-result channel.
Hard, ambiguous, or externally invalidated state → ABORTED / RECOVERY_REQUIRED · never agent-steered.
The correction flow above is the designed v0alpha2 behavior, not yet implemented. Shipped today: v0alpha1 stages effects and signs terminal evidence against simulated settlement. Live provider execution is the next milestone.
More than another per-call permission gateway.
Allowlists and per-call approvals exist. The hard part is keeping one authority, state, and evidence boundary while the agent changes course across systems.
Credentials terminate at the boundary
The agent calls a broad tool surface without ever holding provider credentials. Every modeled mutation passes the same revocable boundary.
The run - not the call - is the unit of control
Delegation, budgets, approvals, and prior effects carry across the session. Individually valid calls cannot escape the run-level boundary.
Control continues after authorization
Adapter contracts connect each decision to staging, settlement, compensation, and recovery. Signed evidence records who delegated, what ran, and how it ended.
One bounded session around the entire agent run.
The model chooses its route. Clared keeps every mutating path inside the rules established for that run.
Delegate bounded authority
A trusted harness opens a session: principal, tools, resource scope, typed budgets, expiry. The agent receives a revocable capability, not credentials. Child agents inherit only leased sub-budgets.
principal · resources · budgets · ttl
Govern and steer the trajectory
Policy evaluates authenticated facts, not model claims. A staged effect can open an obligation that reaches the agent through the ordinary tool result, steering the run to a valid finish. Replan and stop stay reserved for runs that cannot comply.
GUIDE · QUIESCE · SETTLE
Settle with explicit outcomes
At quiescence, Clared fences new actions, revalidates the final state, prepares settlement, and releases approved effects. Uncertainty becomes an explicit degraded state, never false atomicity.
SETTLED · PARTIALLY_SETTLED · RECONCILED · ABORTED · RECOVERY_REQUIRED
One authority model. Different settlement semantics.
A database, a payment API, and a messaging service cannot be controlled the same way. Each adapter declares, per operation, what can be staged, reversed, or only acknowledged as uncertain.
Native transactions on a pinned connection: BEGIN opens lazily, physical leases stay bounded, and the commit releases only at settlement. Roll back on abort.
Provider-native holds and drafts return verified data without releasing the final effect.
Deterministic request keys per session; declared compensators where the provider supports one. Escalate instead of guessing when uncertain.
Defer sinks when possible. At any point of no return, require an explicit checkpoint and persist the recovery boundary.
No universal distributed rollback. The guarantee is narrower: apply the strongest declared semantics each provider exposes, and never describe uncertainty as success.
Inspect the boundary today.
The public repository is an experimental in-memory reference implementation: delegation, capabilities, Cedar policy, budgets, lifecycle, simulated settlement, signed evidence.
Building bounded execution alongside practitioners.
We collaborate closely with high-conviction engineering teams to test bounded authority, validate real-world blast radiuses, and safely unlock autonomous agent operations.
Design Partner
Builds AI automation, API integrations, and custom software systems. Creators of Teleclaudius, a private autonomous business operator.
Financial & Ledger Automation
Multi-system reconciliation, dispute handling, or transactional pipelines where single-call approval models fail to contain run-level risk.
Multi-Tenant Agent Infrastructure
Production agent platforms needing delegated session scoping, runtime budget isolation, and verifiable settlement receipts.
What valuable agent workflow are you not willing to turn on?
We are looking for consequential workflows that stay read-only, manually approved, or blocked by security review. Together we map the authority boundary and the smallest safe staging proof.