The Membrane

The fail-closed control point for AI agents with production access.

Every model call and every tool action carries a live, signed authorization — or it never reaches production.

Run it locally View on GitHub

The problem

Agents have the keys. Logs can't prove who authorized what.

Enterprises are handing AI agents real write access: agents that merge code, change infrastructure, edit tickets, and touch customer data. When an agent does the wrong thing, teams are left with scattered logs and vendor chat histories — editable, incomplete, and unable to prove that an action was authorized by an unexpired policy. Incident reconstruction is slow and unreliable.

The solution

A gateway that fails closed.

The Membrane sits directly in front of your agents. It requires a live, signed authorization for every model and tool call, records each action in a tamper-evident, hash-linked receipt chain, and blocks or severs the agent the moment the chain breaks. Approved actions are provable; unauthorized ones never hit production.

Why it's different

Enforcement and evidence, bound to the action.

01

It enforces, it doesn't just watch.

Observability tools explain what an agent did after the fact. The Membrane is an inline control point that refuses unauthorized actions before they reach production.

02

Authorization is bound to the action, not the prompt.

Every action carries a signed policy naming the exact model, tools, and scope, linked into a tamper-evident receipt chain. A silent model or tool swap breaks the chain and is blocked.

03

Incident reconstruction in minutes.

Because approvals and actions are hash-linked, security can trace any action to its authorizing policy and issuer — and hand auditors a signed evidence pack. No dependence on a vendor's mutable logs.

The demo, in six steps

Grant scope. Allow. Block. Sever. Reconstruct. Prove.

  1. Grant scope

    An operator issues a 15-minute authorization for a support agent: one model, tools limited to jira.comment and slack.post, bound to one task.

  2. Approved action

    The agent posts a ticket comment. A green, linked receipt shows policy → model → tool, all matching and chained to the prior receipt.

  3. Blocked swap

    The agent reaches for a different model, or for github.merge — outside the authorization. The Membrane blocks it; a red receipt shows exactly why.

  4. Expiry / sever

    The authorization expires, or security hits sever. The next tool call fails closed; an alert lands in the incident channel.

  5. Reconstruct

    Security opens the timeline, clicks any action, and sees the model, context scope, policy, and issuer behind it — no log spelunking.

  6. Export evidence

    One click produces a signed evidence pack. Verify the hash chain offline in seconds.

Run the demo locally to walk through each of these steps yourself.

Run it locally

One command. No relay, no secrets, no paid APIs.

The local dashboard walks the full fail-closed narrative — issue, allow, block, sever, evidence — backed by real Membrane gate checks and CP receipt chaining, using ephemeral keys and an in-memory bus. 

# clone the repo
git clone https://github.com/Z0rlord/the-membrane.git
cd the-membrane

# launch the Membrane landing demo dashboard
cargo run -p membrane-cli -- landing-demo

Then open http://127.0.0.1:8790/

Demo instructions View on GitHub

Honest scope

What The Membrane does — and what it doesn't.

The Membrane enforces and proves the traffic routed through it. It does not make claims about an agent's hidden reasoning, data deletion, activity that bypasses the gateway, or regulatory compliance on its own. Coverage is limited to gateway-routed model and tool traffic.