I keep seeing the same gap in the agent-tooling space.
We're building systems that hand AI agents more permission — OAuth grants, delegation receipts, scope tokens, child-agent chains. Every layer answers the same question: what may the agent do?
Almost nobody is answering the question that actually protects you: what must it never do — no matter what?
That's the gap SovereignRoot sits in. It's a working protocol for a portable, cryptographically signed sovereignty.json: a human-owned root constraint policy that sits above your agents, your models, your vendors, your prompts and your delegation chains.
The invariant
Effective authority = delegated authority ∩ SovereignRoot allowed authority
Decision precedence:
DENY > REQUIRE_APPROVAL > ALLOW
A downstream grant — an OAuth token, a child-agent credential, a system prompt, retrieved memory, an operator instruction — can never override a root deny. SovereignRoot is a ceiling, not a grant.
Why this is a separate layer
Agent authorization systems focus on identity, delegation and scopes. That's good and necessary. But they're all per-task or per-vendor.
A root policy outlives all of it. It survives:
- model changes (swap GPT for Llama tomorrow)
- vendor changes
- task grants
- OAuth tokens
- prompts and conversations
- child-agent trees
Your boundary is yours — not tied to whichever model or platform you happen to be running today.
The honest part you should care about
I'm not going to oversell this. A signed policy file does not force a non-conforming AI to obey it. If a runtime ignores the file, or an agent bypasses the enforcement point, the policy is advisory, not hard enforcement.
Hard enforcement exists only when a trusted component the agent can't bypass verifies the signed root and evaluates the action before it executes.
That's the difference between a policy that's decoration and a policy that's a boundary. SovereignRoot gives you the portable, signed, verifiable root. It doesn't pretend to be the enforcement point itself.
The crypto, properly done
- Local ECDSA P-256 key generation (Web Crypto)
- RFC 8785 JSON canonicalization before hashing
- SHA-256 payload digest
- RFC 7638 / RFC 9278 JWK-thumbprint signing identity
- Encrypted private-key export (PBKDF2 + AES-256-GCM)
Everything runs in your browser. Nothing leaves your device. No account, no upload, no cookies, no analytics, no backend.
What it ships with
- a guided policy generator with four presets (Balanced / Strict / Developer / Lockdown)
- a drag-and-drop signature verifier (trust the signature, not the website)
- a working specification
- a JSON Schema
- a reference verifier and policy engine
- full docs and a test suite
All under Apache 2.0.
Try it
Generate your root policy: sovereignroot.pages.dev
Read the spec: github.com/BryanFiFife/SovereignRoot
It's a working draft — not an IETF, W3C or NIST standard. That's intentional and honest. If you build agent tooling, I'd genuinely value your eyes on the spec and the enforcement-model questions in it.
SovereignRoot is a technical policy format, not legal advice or a guarantee of AI safety. Keep secrets — passwords, keys, tokens — out of your sovereignty.json; it's a policy document, not a secret store.
Top comments (0)