Your AI agent now needs a badge, a scope, and an alibi

What it does

OrgKernel is a Python/FastAPI governance layer that treats AI agents like employees who need badges and boundaries. Its completed Phase 1 provides three concrete primitives: an Ed25519-based PKI service that issues and revokes agent certificates, a token service that mints mission-scoped permissions with tool allowlists and numeric bounds, and an audit service that writes SHA-256 hash-chained records across three semantic layers. Notably, it does all this without ever running an AI model itself.

The interesting bit

The project thinks like a paranoid enterprise admin rather than a research lab. Execution tokens are signed by the Org CA to prevent token grafting, scope checks verify both the tool and the caller’s identity on every call, and the audit chain uses per-layer SHA-256 hash chaining so tampering or reordering leaves obvious fingerprints. Even the challenge-response authentication uses one-time nonces with a five-minute TTL to stop replay attacks.

Key highlights

• Phase 1 delivers three working modules (Identity, Execution Token, Audit Chain) across 27 REST endpoints; five more phases are mapped out but not yet built.
• Agent identities use server-generated Ed25519 keypairs: the private key is returned exactly once and never persisted, while the certificate lifecycle supports revoke, suspend, and reactivate.
• Tokens carry tool allowlists, numeric parameter bounds, and Ed25519 signatures to prevent grafting; scope checks enforce both token validity and caller identity.
• Audit trails split into three layers—IDENTITY, EXECUTION, and COMPLIANCE—with independent SHA-256 hash chains and a verification endpoint that detects deletion, tampering, or reordering.
• Supports PostgreSQL, MySQL, or SQLite persistence and is built on FastAPI with Python 3.10+.

Caveats

• Phases 2 through 5—including the 8-state mission lifecycle, Tool Gateway, Policy Engine, Authority Graph, and Data Classifier—are currently planned but not implemented, so the full “Mission Launch → Approval → Tool Execution → Close” flow remains a roadmap item.
• The README describes several future behaviors (like MissionService.escalate() being the only path to the L3 Compliance audit layer) that do not yet exist in code.

Verdict

Worth evaluating if you are building a multi-agent platform and need an open-source trust anchor with cryptographic identity and auditability. Skip it if you are looking for a complete, out-of-the-box agent orchestrator—this is strictly the security kernel, and much of the surrounding machinery is still on the drawing board.