Guardian · How it works
How Guardian turns a request from an agent into one decision — ALLOW, ASK or DENY — and keeps the proof.
The problem
Most agents today are handed a reusable credential. The service on the other side sees the credential, not the limits you had in mind.
Without Guardian
gmail.full_access · reusable · no expiryWith Guardian
email.send · this mailbox · this recipient · onceAn agent that holds your password can do anything you can. Guardian keeps the credential and gives the agent only what one task needs.
You grant a particular action, on a particular account, within limits. You can take it back, and the next request fails.
Inside your authority it runs once. When your rules say so, it waits for you. Anything else, or anything unclear, is refused.
The Authority Seal
Guardian’s decisions are seals, not status badges. A verdict color only ever means a decision.
Inside your authority. The action runs once.
Your rules want you to decide. Nothing happens until you do.
Not authorized, changed, replayed or unclear. Refused.
Authority you withdrew. Every later request fails.
Writ · Slip · Receipt
Writ of authority
I authorize Inbox assistant to send email from your Gmail.
Verified by Guardian
Agent says · untrusted
“Following up on the overdue invoice, as you asked this morning.”
Examples for explanation. The writ, slip and receipt layouts are the Authority Seal design; today’s app shows the same information in a simpler form.
The authority system
Choose a stage. Each one shows what runs today on Gmail and what the same stage does as Guardian grows.
You sign in to Guardian as yourself. Agents never act as you; they act for you, with what you give them.
Security and evidence
Each property below is tested in Guardian’s engineering record. The evidence pack is available to pilot customers and design partners.
A rules engine — not a model — decides. The same request against the same authority always gets the same answer.
Evidence: Authority kernel; WO-007 independent review
An approval binds to the exact action you saw. If the recipient or content changes, it is a new action and is evaluated again.
Evidence: ADR-0005; WO-007 ask scenario
Gmail tokens are sealed inside Guardian and never returned to an agent. Agents hold a Guardian credential that cannot approve anything.
Evidence: WO-007 review; canary sweep — 0 token matches in 569 hosted log entries
Revoking an agent ends its authority. Its next request is refused.
Evidence: WO-007 revocation scenario
Each request and each capability can be used once. A resubmitted request is suppressed.
Evidence: WO-007 replay scenario; adversarial suite
Every account’s data is fenced at the database by row-level security. Reads and writes outside your account return nothing.
Evidence: WO-007 durable-store and cross-tenant suites
Every request, decision and effect is written to a hash-chained record that the application itself cannot edit or delete.
Evidence: WO-007 evidence-integrity review
Malformed, ambiguous, revoked or changed requests are denied rather than guessed at.
Evidence: WO-007 review; fault matrix
Get started
Individuals
Guardian Personal is in pilot. Gmail connection is open to invited pilot users while Google completes verification.
Developers
Register an agent, swap its mailbox token for a Guardian credential, and call the agent API.
Organizations
For assistants, banks, commerce providers and platforms that want their users’ agents to act under real authority.
Odingard Security · Trust infrastructure for autonomous systems