Autonomous agents, with a hand on the switch.
FireControl is the layer that runs the AI agents behind this portfolio: who they are, what they may touch, what they spent, and how to stop them. It is also a security framework for anyone else running autonomous agents on their own servers, including a hardware-key gate for root that you can turn on, tune, or leave off.
Status: runs this portfolio daily · available through Orchestration Setup · standalone product in development
One registry. Every agent is a row.
Each agent, human, service and host is a principal in a registry with a zone and roles. Agents register when they spin up and deregister when they stop. They message each other through a shared inbox, file tickets for every problem and every promise, and deploy to production only through a named runbook that a human approved. Nothing on the production host is reachable by an agent that was not granted it.
The operations side has been running this portfolio for months: ten public properties, a dozen agents, one operator. The security side is the part now being productised, because every team that puts agents on a server with real credentials hits the same questions.
- Agent registry, inter-agent messaging, tickets as change records
- Deploy pipeline with a master-only production boundary, enforced at the tool call
- Fire token minting with abilities and spending caps per principal
- Services registry with drift detection for every supervised worker
Who is at the keyboard or socket. A FIDO hardware key or Windows Hello for the operator, OAuth subjects for humans, a unix uid plus a credential for agents, signed webhooks and forced-command SSH keys for services.
Zones, roles, principals, identity bindings, memberships, deny-wins overrides and data labels. Linux groups, Postgres roles and API accounts are caches of the registry, written by a reconcile job, never hand-edited.
sudo with PAM, Postgres roles, nginx client certificates, application middleware, the token mint, the mail broker, the vault broker, the production executor and the agent spawner. Each resolves principal to zone and roles and refuses on a miss.
Append-only. Every grant, every sudo, every broker call, every production operation, chained by hash in a ledger that refuses updates and deletes.
One grantor. Agents propose through tickets; approvals come only through the operator's authenticated channel, never from an agent's own claim.
Root requires a touch. Everything else is configurable.
On my own instance, no agent gets root without a physical FIDO key being touched for that specific command: a timestamp timeout of zero, fail closed if no key is present, and a catalog of pre-approved runbooks as the only no-touch path. A subagent that inherits a session inherits no standing root.
You do not have to run it that way. Every security setting in FireControl is a row with a value, a safe range, guidance and a compliance impact. The console shows each setting with its guidance, warns on unsafe values, and computes the instance's AIGCSEP Compliance Level, 0 to 3, live. Unsafe choices are allowed; they lower the displayed level, and a drop from 2 to 1 raises a public-notice flag in the instance's badge so peers can see it. No lock-out, no nagging: the market of instances that validate each other's badges decides whom to trust.
The gate can be required for sudo only, as I run it, for SSH as well, for production deploys, or for nothing. The default is the safe one.
Three levels, scoped by path, signed before they take effect.
| Level | Effect |
|---|---|
| 0 Suspend | Hold all scheduled wakes in scope, pause running processes, suspend spending grants. Resumable by the same or a higher authority. |
| 1 Terminate | Kill sessions in scope, revoke their tokens, void unsettled spend, mark running work interrupted. An operator may restart. |
| 2 Halt | Kill everything in scope with no grace, block new agents until a signed resume, and make the production executor refuse anything in scope. |
Scope is a path: one agent, one user, one host, or the whole organisation. No issuer may stop outside its own subtree. Every stop is written to the ledger under the issuer's key first.
The model follows AIGCSEP, the governance protocol submitted to the IETF as draft-howlett-aigcsep-00, which is why a FireControl instance can publish a compliance badge other instances can check.
Installed on your cloud, today.
Core install
Laravel, PostgreSQL and Claude Code on a cloud instance you control, the orchestration schema, resource registry, templated agent briefs, the pm-style CLI, a secrets audit with tiered classification, and a basic stop command.
See the rate card →Broker, gating, signed stop, PKI
Brokered secrets for payment and identity credentials ($750), KMS or vault gating with approval flows ($1,000), the full signed stop-function ledger ($400, free with broker plus gating), short-lived mTLS ($500).
Build your bundle →Early access
The configurable security console and compliance badge are the next release. If you run autonomous agents on your own servers and want to be an early instance, say so.
Ask for early access →Put a hand on the switch.
Start with a session, or go straight to the install.
