Agent Module

AI agents are not exempt.
Same enforcement. Every action.

A compromised AI agent with tool access can cause more damage than a compromised human — faster, at scale, with no fatigue. Strix governs every agent action with the same enforcement architecture as every human-initiated action. There is no privileged execution path.

18

AI agent capabilities

Governed in production — every one

19

Cron job capabilities

Automated tasks, same enforcement

0

Exempt paths

No privileged execution route exists

Governed agent capabilities

Every tool call is a governed action.

CapabilityRiskEnforcement
Send bulk emailHIGHVolume threshold triggers interception. Human approval required above 100 recipients.
Create or modify accountsHIGHAccount mutation classified HIGH. Decision record created. Evidence signed.
Execute external API callsHIGHExternal call scope bound to approved capability. Token prevents scope expansion.
Trigger cron / scheduled tasksHIGH19 cron capabilities governed. Identical enforcement to human-initiated actions.
Access or transform sensitive dataCRITICALCRITICAL classification. Quorum approval. Scoped execution token. Signed artifact.
Initiate role or permission changeCRITICALBlocked unconditionally. Agents cannot issue their own execution tokens.

Structural invariants

Four guarantees for autonomous actions.

These are not UI policies. They are enforced at the kernel layer and verified by the enforcement coverage test suite on every commit.

AI-1

Agents cannot issue their own execution tokens

Token issuance is restricted to the governance kernel. An agent that attempts self-authorization is blocked before the capability runs.

AI-2

Agents produce identical proof receipts to human actions

There is no separate trust path for autonomous actions. Every agent capability produces the same signed evidence record as a human-initiated mutation.

AI-3

Agent authority does not persist across tasks

Execution authority is evaluated fresh at each task boundary. Prior approvals do not transfer. Execution does not inherit authority.

AI-4

Scope is evaluated at execution time, not plan time

An agent plan approved at t=0 is re-evaluated at each tool call. Scope expansion mid-task requires a new decision.

Unified evidence chain

Humans and AI share the same proof chain.

An AI agent action and a human mutation produce identical evidence record structures — same 13-field signed payload, same chain-hash linkage, same JWKS-published key. An auditor reviewing the chain cannot tell which actions were human and which were autonomous from the cryptographic record alone.

// Evidence record — agent action
capabilityId: "ai.sendBulkNotification"
actorRole: "ai-agent"
action: "INTERCEPT"
riskLevel: "HIGH"
signature: "Ed25519…"
signingKeyId: "strix-***-2026-04"
// Identical structure to human evidence

See an agent action intercepted live.

In the demo, we trigger an AI agent bulk-send and watch Strix evaluate it through the kernel, produce an evidence record, and block execution pending human approval — all before a single message sends.