CAPABILITY SEALS
Agents and skills receive only the file, network, Git, shell, messaging, or deployment access they need.
SECURITY MODEL
Autonomy needs boundaries
Karnelian is built around least privilege: agents request specific powers, risky actions wait for approval, workers remain isolated, secrets stay encrypted, and privileged events enter a verifiable ledger.
GOVERNED EXECUTION
Human authority stays in the loop
Authority is resolved before execution, not explained away afterward. The same chain applies whether a task starts from Lian, the CLI, or an API.
01
Declare
A skill manifest states its runtime, resources, and required capabilities.
02
Evaluate
Deny-by-default policy compares the request with granted authority.
03
Approve
Sensitive actions enter a human approval queue before they can proceed.
04
Isolate
The selected worker executes inside its bounded runtime.
05
Attest
Signed authority and ledger events identify the request, decision, and outcome.
DEFENSE IN DEPTH
Controls that remain understandable
APPROVAL QUEUE
Destructive or externally visible actions pause until an operator explicitly allows them.
WORKER ISOLATION
Specialized runtimes contain execution and keep one failure from becoming system-wide authority.
SAFE MODE
An emergency control suspends risky capabilities and narrows the system to controlled operations.
ENCRYPTED SECRETS
Sensitive values use AES-256-GCM encryption at rest rather than entering prompts or logs as plain text.
SIGNED AUTHORITY
Ed25519 attestations establish who requested, approved, and executed sensitive work.
AUDIT LEDGER
Quantum-entropy-enhanced, not post-quantum
Ledger records are linked with BLAKE3 hashes and can receive MAGIC-sourced entropy salts. The chain supports verification, slices, and anchoring, but it uses classical cryptography today.
- Hash chaining exposes retroactive record changes
- Quantum entropy may strengthen salt unpredictability
- Verification can cover the complete chain or a slice
- Post-quantum signatures are explicitly a future roadmap