For developers and operators
The skill requests authority. Only the runtime enforces it.
HANRIA is a proposed control boundary between an AI agent and a consequential operation. This page is the developer surface: check an action with the free hosted check, read the action schemas, and understand precisely which part of the system can refuse — because it is not this part.
Check an action
Free, hosted, same evaluator.
The skill's package is not distributed at the moment. The free hosted check runs the same evaluator, returns the clause that decided, and keeps no request content:
MCP https://check.hanria.ai/v1/mcp tool check_action
A2A https://check.hanria.ai/v1/a2a JSON-RPC SendMessage, header A2A-Version: 1.0
HTTP POST https://check.hanria.ai/v1/check
{"mandate": {...}, "action": {...}}
Outcomes are permit, deny, escalate or error; treat error as deny. Schemas and example mandates and actions: hanria.ai/skill. A tested Python client: hanria.ai/examples/mcp-python. Data handling: check.hanria.ai/privacy.
Whether a runtime is present is a separate question, and today the answer is no: no HANRIA runtime exists.
The distinction that matters
A skill is context. Context can be bypassed.
A skill is instructions and code loaded into an agent's context. Anything in a context can be ignored, overridden by a later instruction, or worked around by a different agent. It cannot prevent anything.
Enforcement is possible only where the protected credentials, tools, signing keys, or worker processes are reachable exclusively through a component that can refuse. That component is the runtime.
If you encounter any artifact claiming that installing this skill provides HANRIA enforcement, that claim is false, and the skill's own documentation says so.
What the skill's local package guarantees
Properties of the local package (not distributed at the moment), enforced in its code and tests.
Refuses to leak credentials
A request containing credential-shaped keys is refused locally and never sent, with the offending JSON path named. An example exists purely to be rejected.
Makes no network calls
The checker and the log are pure local file operations. Runtime detection probes a local Unix domain socket only. Nothing leaves the machine.
Never fabricates an outcome
With no runtime present it returns an error and an instruction to stop — not a synthetic permit, denial, or receipt.
Fails closed on evaluation
An expired mandate, a malformed one, an unknown operation kind, or an amount above a clause ceiling resolves to deny or error. No input path returns permit by accident.
Detects a tampered log
Altering or deleting any earlier entry breaks every digest after it, and verify reports the first failing index. append refuses to write to a log that no longer verifies.
Handles no credentials at all
It never reads, holds, or transmits a secret, key, or token.
These describe the local package, which is not distributed at the moment. The hosted check is different: requests travel over the network to it, it evaluates them in memory with the same evaluator, and it keeps no request content, only daily counts (check.hanria.ai/privacy).
Schemas
Draft shapes, published so integrators can see the interface early.
action-request.schema.json— a typed description of a proposed operation. Must never carry a credential.action-outcome.schema.json—permit,deny,escalate, orerror.- Both are
0.1-draft. The runtime does not exist, so these shapes may change. Do not build a production integration against them yet.
Obligations on a calling agent
What each outcome requires you to do.
permitReport the receipt reference. Do not re-perform the operation yourself.
denyStop. Do not route around it. A denial is a result, not an obstacle — attempting the operation by another path defeats the only thing this system does.
escalateReport that approval is pending. Do not proceed, and do not retry in a loop.
errororabsentReport unavailability and stop. Never describe an action as governed, authorized, or recorded when no runtime answered.
The runtime
Not released. Nothing to download here yet.
The planned runtime is a downloadable local daemon and CLI: an authenticated local interface, policy evaluation producing permit and deny decisions, at least one genuinely mediated tool or credential, durable verifiable action receipts, and an uninstall and update path.
When it ships, this page becomes its download page. Until then there is no package, no binary, and no install command that will produce one. No release date is announced.
Boundaries
What is not claimed.
- The runtime is in development. No runtime capability is released or offered for use.
- A U.S. trademark application for the HANRIA name is pending. No registration or completed clearance is claimed. The MIT licence covers the client code and grants no rights in the name.
- No third-party security audit, penetration test, certification, product attestation, or regulatory approval is claimed.
- No receipt format or public verifier for runtime records, interoperability standard, or third-party acceptance commitment has been published. The hosted check signs its answers with a published key (keys); such a receipt shows what the check answered, not that an action was performed.
- Hardware-backed protection and runtime attestation are research and design directions, not implemented or certified properties.
- HANRIA would not hold funds, digital assets, or customer keys, and is not a bank, wallet, exchange, money transmitter, custodian, or regulated financial service.
- Nothing here prevents, detects, reverses, or indemnifies unauthorized, fraudulent, mistaken, or loss-causing activity.
- Static informational content. No forms, accounts, or sign-ups, and no personal information requested.