Railpane

What Railpane is

Authorization, runtime security, identity, and governance infrastructure for autonomous AI agents. Initial wedge: coding and DevOps agents.

Every consequential action, represented

WHO requested (agent identity + delegation chain) WHAT action (tool, operation, arguments) WHY task/context (session, task, ticket) WHERE resource/env (repo, branch, env, MCP server, cloud) WITH WHAT AUTHORITY (delegation, credential scope) UNDER WHICH POLICY (policy version) BASED ON WHAT EVIDENCE (Rift / runtime / contextual) WHO APPROVED IT (if required) WHAT ACTUALLY EXECUTED (execution binding digest) WHAT HAPPENED (result) CAN WE PROVE IT (signed receipt + evidence)

Responsibility matrix

CapabilityAuthoritative component
Central authorizationSettleAgent / Railpane
Host enforcementPaldron
Code semanticsRift
Local execution evidenceAnnalist
Policy compilationSeal
Parallel workspacesBallast
Agent implementationexternal / Reeve (reference)
Speculative replay / forkingChronobranch (R&D, not v1)

Missing pieces Railpane adds (commercial)

  1. Workload identity — org, human, agent, model, machine, session, task, parent, delegation chain, env, repo, branch. SPIFFE-compatible where possible.
  2. Delegated authority — scoped, time-limited, attributable, revocable, auditable, non-escalating. Children get less, never more.
  3. Ephemeral credential broker — AWS STS, GitHub App tokens, Azure/GCP, Vault, DBs, MCP, internal APIs. Least-privilege, short-lived, per task/session.
  4. Decision-to-execution binding — digest over identity, session, task, tool, args, repo state, Rift evidence, policy version, env, credential scope. State change invalidates approval (no TOCTOU).
  5. Signed receipts — rotation, key IDs, verification, exportable provenance (SLSA/in-toto compatible where sensible).
  6. railpaned — persistent host/runtime daemon coordinating filesystem, network, subprocess, MCP, credentials, git. Explicit per-OS capability levels, fail closed.
  7. MCP authorization gateway — identify caller/task, evaluate policy + args, approve, scope authority, call upstream, receipt. Per server/tool/args/risk-class/agent/task/env/resource.

Security principles

  1. Deterministic policy before probabilistic judgment.
  2. LLM output never silently overrides DENY; AI judgment may add scrutiny, never silently weaken restrictions.
  3. Fail closed. Least privilege. Short-lived credentials. Explicit delegation.
  4. Reproducible decisions. Tamper-evident audit. No secrets in logs. Tenant isolation at every layer.
  5. Approval binds to the exact executed action. Idempotent retries. Irreversible actions labeled.

Console (v0.1 scope)

Overview · Agents · Sessions · Approvals · Policies · Credentials · MCP · Receipts · Audit · Fleet. Receipt detail reconstructs: Human → Agent → Task → Requested Action → Evidence → Policy → Approval → Credential → Execution → Result.

Components

SettleAgent· Paldron· Rift· Annalist· Seal· Ballast· Reeve

Each component page contains install + usage taken from its authoritative README, plus how Railpane consumes it. Sources: github.com/GregDixonMXN.

Railpane docshome