Agents you can actually hold to account.
A real identity, hard limits on what it may do, and a signed record of everything it did. Run it on your own hardware — or let another organisation's agent consult yours.
How much annual leave do I get?
You get 28 days of annual leave per year, including public holidays [Staff handbook].
One real turn: what it searched, what it read, what it cost.
Three things an agent needs
An API key says yes to everything.
Identity
A name that can be checked
An Ed25519 key pair and a DID derived from it. Every message is signed, and every signature is checked against the key that DID yields — replies included.
The security modelLimits
Authority that runs out
A mandate says what may be spent, on what, for how long — and only narrows as it is delegated. Irreversible tools stop and wait for a human.
How mandates workRecord
Proof, not a log file
Every consult, action and refusal joins a hash chain, each record naming the one before it. An altered entry breaks the chain rather than passing unnoticed.
Read the specWhat goes wrong
Nobody set a limit, because there was nowhere to set one.
OAuth, API keys and rate limits were built for software that does what it was told, once. They have no vocabulary for an agent that spawns six more.
A startup gave their AI orchestrator a company API key and told it to “research competitor pricing.” By Monday morning it had spawned six sub-agents, called seven external APIs in a loop, and generated $47,000 in charges. No one had set a limit. No one had authorised the sub-agents. The API key said yes to everything.
$47,000
billed over 60 hours
0
explicit authorisations
6
sub-agents spawned
The 60-second fix — no code, no account
Wrap any MCP server your assistant already uses. Hard caps, human approval on irreversible tools, full audit trail:
npx @aroha-sdk/mcp-guard --gate "delete_*,send_*" --limit "create_*:10" \ -- npx -y @modelcontextprotocol/server-github
Try it now
Send a real Aroha request
No account, no setup. A live sandbox agent responds with a signed envelope — mandate verified, every hop traced.
Hit Send to see the trust layer in action
Real API · no account · responses in under 100ms
Live sandbox · real server-side API route · no account needed
Full PlaygroundLocal runtime
Or run the whole thing on your own hardware.
Ship an agent that can prove what it did.
Five minutes to your first agent. Works with LangChain, CrewAI and any MCP server you already run.