Who approved that agent? A firewall for machine consequences

What it does EMILIA Gate sits at the Model Context Protocol boundary and blocks autonomous AI agents from executing consequential actions—wiring money, deleting code, changing permissions, or mutating regulated state—until a named human approves the exact operation. The approval happens on the operator’s own device via WebAuthn or passkey, and the resulting signed receipt can be verified offline by anyone without trusting EMILIA’s servers. It is essentially a deterministic policy engine that consumes each authorization once and leaves tamper-evident proof behind.

The interesting bit The project treats authorization as an evidence problem rather than an access-control problem. It ships an open Apache-2.0 verification substrate alongside a commercial gate, backs its security claims with 20 Tamarin lemmas across composed Dolev-Yao models, and deliberately includes weakened variants that generate concrete attack traces when load-bearing checks are removed.

Key highlights

• Hooks tool calls natively at the MCP layer without rewriting the underlying services.
• Human signoff binds to a deterministic hash of the exact action via device-native biometrics.
• Receipts are cryptographically signed and verify fully offline with no backend, blockchain, or zero-knowledge ceremony.
• The repository resolves 35 security claims over 255 hashed evidence files and maintains over 8,600 automated tests.
• An IETF Internet-Draft defines the authorization-receipt format for independent interoperability.

Caveats

• The README repeatedly warns that local demos and reference proofs use ephemeral state, generated keys, and mock providers; they do not demonstrate real human review, production deployment, or end-to-end integration.
• The Gate prevention layer is commercial software; the open protocol covers verification and evidence, but blocking execution on protected paths requires the paid product.

Verdict Worth studying if you are building agentic systems that touch production, capital, or compliance boundaries and need audit-ready proof of who authorized exactly what. Less useful if you need a fully open, self-hosted execution firewall at scale; the protocol verifies receipts independently, but the prevention layer is positioned as a commercial product.