A note on how this was made, up front: I had the idea. AI helped me build it. A second AI reviewed it adversarially. I was the human gate on every decision that mattered. More on that — and the three bugs that process caught — below.
The idea
AI agents are being handed the keys to real infrastructure — networks, servers, devices — and almost nothing sits between "the AI decided to do something" and "the thing happened." The tooling everyone's excited about gives AI hands. Almost nothing gives it rules.
I wanted control over what does and doesn't happen on my own network. Not a firewall, not a VPN — those secure the pipe. I wanted control over the decision: which agent is allowed to do which thing, and, for anything that could actually hurt, a guarantee that a human says yes first.
I named it AXIOM before I understood how well the name fit. An axiom is a foundational truth everything else is built on — from the Greek for worthy, literally to weigh and judge what is worthy. Which is exactly what the thing does: it weighs every request an AI makes and decides what's worthy of being allowed.
The name was the spec.
The turn
AXIOM began as a "secure connection" project. But the deeper I went, the clearer it got that connection was the easy, already-solved part. The hard part — the part nobody had a clean answer for in a self-hosted setting — was authorization: not can they reach it, but are they allowed to do this specific thing, right now, with these exact parameters, and if it's dangerous, does a human know?
The moment I stopped thinking of it as a network protocol and started thinking of it as a gateway that judges requests, everything fell into place. Every action an AI wants to take passes through one wall. Harmless reads happen freely. Sensitive actions get logged in full. Anything destructive stops dead until I personally approve the exact action.
How it was built (I'm not going to pretend otherwise)
I had the idea. AI helped me build it. A second AI, acting as an adversarial reviewer, tried to tear each piece apart before it was allowed to stand. I was the human gate on every decision that mattered. Nothing shipped without surviving a build pass, an adversarial review, and me. I'm not dressing that up — it's how the thing got made, and the method is part of why I trust the result.
The proof the process worked isn't that it went smoothly. It's the three bugs it caught — each a guarantee that had to be made real instead of assumed.
One: the wall that went quiet. For two days, a fail-closed path was silently failing in a way that looked fine from the outside. Everything appeared to work; the guarantee underneath had a hole. It surfaced only under real conditions the earlier tests didn't exercise. A system whose whole promise is "it fails safe" cannot afford a silent failure — this was the difference between a wall and a picture of a wall.
Two: the regression the reviewer caught. Fixing one verification behavior quietly broke a guarantee one layer down — a path nothing used yet, so nothing visibly failed. It would have sat there latent until something relied on it. The adversarial pass caught it: exactly the kind of thing a single builder, human or AI, misses because they're looking at what they meant to do, not what they actually did.
Three: the denied action that executed anyway. The one that matters most — and we went looking for it on purpose. In adversarial testing, a destructive action was denied, and executed anyway. That's the single worst thing an approval wall can do: tell you it stopped something it didn't. We reproduced it deliberately, confirmed it, fixed it, and built a permanent test that fails if it ever returns. I'd rather show you that happened and hand you the test that guards it than pretend the wall was born perfect.
A wall you can't verify is just décor.
None of these were detours. I knew what the framework had to guarantee, and each bug was one of those guarantees demanding to be made real. That's the point of an axiom: you don't get to assume it — it has to hold.
What it is now
A self-hosted authorization gateway for AI agents. Every capability an AI can invoke is declared, tiered by how much damage it could do, and gated:
Deny by default. No grant, no action. An empty policy allows nothing — not "falls back to permissive."
One identity per agent, granular grants. Each workload gets its own key and only the capabilities you've explicitly given it.
Human approval on anything destructive. The AI proposes; you see the exact action; it doesn't happen until you approve — and approval is bound to those exact parameters, so it can't be swapped after the fact.
A tamper-evident audit log. Every request, allowed or denied, in a hash-chained record you can verify.
It can't lock you out. The things that keep you in control are walled off from anything the AI can touch, by design.
It's a single-owner, self-hosted tool. Use it at your own risk, read every line — that's the point, and it's open source specifically so you can.
If you want to see whether the wall actually holds: I didn't write "trust me." I wrote the adversarial test suite. It's in the repo. Start there.
larro1991
/
axiom-core
Fail-closed capability gateway for AI agents on your own infrastructure -- tiered permissions, human approval on destructive actions, tamper-evident audit log
AXIOM
Give your AI agents access to real infrastructure — with a fail-closed wall that makes them ask permission before anything dangerous.
Real approve/deny cycle - real Tier2ApprovalFlow, real tamper-evident audit
log, real MockDestructiveCapability built for exactly this kind of
rehearsal (see axiom-gateway/examples/demo_approve_deny.rs). The terminal
channel stands in for forge-node's actual Telegram-based approval - a phone
tap doesn't record cleanly to GIF. That real Telegram flow is captured
below, unedited, from an actual production run.
Live demo: a real destructive action, denied, in production
Unedited output from an actual run, 2026-08-21 — a throwaway node proposes creating a WireGuard peer (Tier 2, destructive), a real Telegram prompt goes to the owner's phone, the owner taps Deny, and the tamper-evident audit log is the only source of truth for what actually happened next:
$ bash axiom-demo-deny.sh
=== AXIOM: real Tier 2 destructive action, denied live ===
3. Sending aBuilt in the open, reviewed adversarially, gated by a human who wanted to know exactly what his AI was about to do. MIT licensed. — the AXIOM project
Top comments (0)