SweeTrustv0.6.0 · TypeScript

Trust rails for AI agents. Issue authority, enforce it, prove what happened.

The problem

SweeTrust stops an AI agent from paying a bank account it read in an email. Types constrain shape. Nothing constrains pedigree. An account number pulled from an inbound email has the type string. So does one from your own vendor registry. Your payment function cannot tell them apart.

One package, three parts

mandate holds what a person granted, in bounded tiers: an out-of-tier grant does not compile, and is refused again at runtime. A grant can cap what an agent spends, summed from the signed log, so a restart refunds nothing. gate is the enforcement point, and a sink fails closed when the pedigree is missing. verify lets a stranger check the record against a key they trust.

Why it holds

Model output is born untrusted no matter how good the model. Inference is not evidence. Three declassifiers are the only way up, and the constructor is module-private at runtime too, so there is no fourth. Every sink decision, allowed and refused alike, lands on a hash chain.

What it does not do

It makes no chain calls, so revoking a mandate here stops no money a chain already holds. On Sui that kill switch is the chain’s own sui::allowance. Deleting the last few records leaves a valid shorter chain, which only an anchor catches. Code running in the same process can lie its way past it. SECURITY.md lists twenty-nine such limits.

Published on npm · Apache-2.0 · zero runtime dependencies

sweetrust 0.6.0 on npm Source on GitHub

Request

const email   = Sourced.fromChannel(raw, 'email-inbound')
const account = Sourced.fromLLM(iban, 'ExtractInvoice', [email])
const amount  = Sourced.fromLLM(40_000, 'ExtractInvoice', [email])

// pay = makeSink({ requires: { to: 'verified', … } })
await pay({ to: account, amount })

Response — the interesting branch

{
  ok: false,
  refusal: '⚠ pay refused: to requires verified
    but is UNTRUSTED (origin: llm:ExtractInvoice) · …',
  receipt: {
    decision: 'refused',
    seq: 0, prevHash: 'genesis',
    hash: '29ad0c14…',
  },
}

The refusal is a receipt too. It sits on the same hash chain as every allowed call, so a stranger can audit what was stopped as well as what went through.

Pedigree — and the only ways up

untrusted
where model output is born
corroborated
independent sources agree
verified
a registry you control matches, or a person said yes with the provenance in the question

A chokepoint — the wall across the only route

MANDATEwhat a person grantedgrants authorityGATEAGENTwants to actasks to actSINKchain · api · spendonly if permittedemits recordVERIFYcheckable without trustThe authority a person granted —what may be spent, on what, anduntil when.The enforcement point everyaction passes through. Nothingreaches a sink without clearing it.The record made afterwards, in aform that does not require trustingwhoever produced it.
There is no route from left to right that misses the band. That is the whole product in one shape — and the reason the gate is drawn as a wall rather than a box is that a box is something you can go around. HoverTap any dotted term for its definition.