Ask with a reference
The model sees a capability reference such as cap_weather_read_7f3d. It does not receive the provider credential.
How it works
A request reaches a policy checkpoint before it reaches a tool.
CanaryNorth gives an AI a scoped way to propose an action, gives a person a decision point when policy requires one, and records what happened.
In one linePropose, verify, approve when required, record.
The demo uses synthetic requests and tools. The policy and receipt path are real application behavior.
The flow
Four things happen
Check the request
The boundary checks the action, resource, scope, freshness, and content. The request is not trusted just because a model made it.
Pause for a person
Higher-risk changes can wait for a human yes or no. No answer means no action in this synthetic workflow.
Leave a receipt
The record keeps the decision, reason, and references. It does not repeat the secret or the unsafe input.
Why the boundary matters
The model proposes. Policy decides whether the request may continue.
The model receives an opaque capability reference, not the provider credential. The server checks identity, scope, resource, expiry, replay state, content, and approval before recording the result.
Try the guided casemodel proposespolicy boundarytool if allowedsigned receipt
Glossary
Terms used here
- Capability
- A narrow permission to ask for one action on a defined resource.
- Opaque reference
- An identifier the model can present without seeing the underlying credential.
- Policy boundary
- The server-side checkpoint that evaluates a proposed action before a tool could receive it.
- Nonce
- A one-use value that helps the server reject replayed requests.
- Approval TTL
- The limited time during which a human approval remains valid.
- Receipt
- A record of the request, decision, reason, references, and verification data.
- Ed25519
- The public-key signature algorithm used by the live service to sign receipts.
Current scope
Synthetic tools, real policy and receipt behavior
The demo covers scoped decisions, approval records, redacted evidence, persistent PostgreSQL storage, and signature verification. It does not connect to external provider tools or real user data.
Next