[Notes] aflock: Cryptographically Signed Policies for Constrained AI Agent Execution

aflock applies familiar ideas from SPIFFE/SPIRE, in-toto, capability systems, and policy engines to agent execution. Rather than trusting an agent to report its own behavior, aflock moves authorization and evidence generation into an external MCP server. Agent identity is derived from introspectable properties; short-lived JWTs convey authority; and the server signs attestations with keys the agent never sees.

Policies can constrain individual actions and cumulative properties of an execution trajectory. Session attestations are committed through a Merkle tree to provide ordering and completeness evidence, while Rego evaluates cross-attestation constraints. Hierarchical sub-agent delegation uses in-toto-style sublayouts with mandatory attenuation, so delegated authority cannot exceed the parent’s constraints.

The broader systems principle is compelling: securing autonomous agents may require treating execution trajectories much like software supply chains—externally constrained, cryptographically recorded, and recursively verifiable—rather than relying on the agent itself to enforce or describe its boundaries.