Firma-AI / openfirma

What it does

• Structural interception. every modality of action funnels through the Sidecar, with the kernel sandbox as the floor
• Deterministic intent. every tool call is classified into an enforceable action class; Cedar evaluates the same input to the same decision, every time
• Per-call enforcement. policy is evaluated before execution, against current policy and accumulated session state
• JIT credentials. a federated broker issues credentials per call on ALLOW; the agent never holds raw tokens; exfiltration is structurally impossible
• Signed audit. every decision emits a signed execution event with the exact envelope the policy saw