What does tamper-evident mean here?

Each event in the log is chained to the one before it. If a row is changed, removed or inserted by hand, the chain no longer links, and ok audit verify names the first break.

Can I replay what an agent did?

Yes. Any run can be replayed, step by step, with what the gate decided at each step.

How do rule changes get approved?

Rules, budgets and kill switches export to Git. CI checks each change, and a change applies only through review.

Can I test a rule before it applies?

CI checks each change before it applies.

Governance

Prove what happened. Change rules like code.

A tamper-evident log of every decision. Replay for any run. Rules, budgets and kill switches kept in Git and applied through review.

Become a design partner See how it works

Proof

A log you can check

Every gate decision, approval, write and run step is an event. Each event is chained to the one before it.

Change, remove or insert a row by hand and the chain no longer links. One command checks it and names the first break.

You answer “what did the agent do, and who said it could?” from the log, not from memory.

terminal

# Check the whole chain. A break is named by its position.
$ ok audit verify

# Replay a run step by step.
$ ok replay --run <run-id>

event log (example)

GateSupport Agent: refund $240 needs approval

next event carries this one's hash

ApprovalAdmin approved the refund

next event carries this one's hash

ActionRefund applied through Stripe, once

next event carries this one's hash

RunRun resumed and finished

policy/rules/refunds.yaml

# A rule, exported from the kernel to Git
- id: refunds-need-admin
  description: A refund needs an admin, whoever asks
  effect: require_approval
  approver: { approver: role, role: admin }
  matches: { tools: [billing.refund] }

$ ok policy export policy/
$ ok policy check policy/
$ ok policy apply policy/

Policy as code

Change rules like code

Rules, budgets and kill switches export to a Git repository. CI checks them. A change applies only through review.

Export what the kernel enforces today to files.
Check every change in CI.
Apply through review: a change waits for a person before the kernel uses it.
Policy dry run (explain): ask what the gate would decide for an action, and why, before anything runs.

The kernel

The gate, runs, approvals, delegation and budgets.

The gate in detail

Each check in order, budgets and kill switches.

Models and data

Data classes, sealed secrets and egress checks.

Frequently Asked Questions

Put an agent on real work, with people in charge

Design partners run one real workflow on OrchKernel and work directly with the engineers building it.

Become a design partner See how it works

OrchKernel is source-available and self-hosted.