Today's agents read files, call APIs, run commands — then log it after the fact. If you can't show who approved what, when, and why, you can't defend the decision. ouros checks, signs, and chains before anything runs — built for environments where that decides whether the system gets used at all.
denials never become actions. they become records.
─═══════════════════════[ THE GATE · LIVE REPLAY ]═══════════════════════─
$ ouros propose <action> — run a real proposal through the gate · rules from default.cedar · click a stamp to inspect
$ ouros tail --gate # live · denials are records too · [ PAUSE FEED ]
ouros is the execution layer underneath AI agents. Every row on the wire was checked against policy, signed by a named human, and chained — before it ran, not after. The denials never became actions at all.
deny-by-default · cedar signed · ed25519 air-gap · runs in a SCIF