Writ: A Status Layer for Delegated Agent Authority

Raising $12,000active

Writ is a lightweight, deterministic security protocol that is crafted specifically to restrict and audit any real-world authority given to AI agents.

Project Details

Writ operates through three main mechanisms:

Deterministic bounds - Enforces hard limits on what an agent CAN do so that it cannot exceed its authorized budget.
Cryptographic Attribution - Every action the agent takes will be signed and logged into a registry that is tamper evident. This creates an audit trail of exactly what the agent did and when.
Fast Revocation - When an agent behaves unexpectedly its credentials can be revoked globally within a 50 second ceiling, effectively stopping it from doing anything further from that point.

I will be the only person involved for the majority of this project, with one independent reviewer brought in if the full budget is granted. This project is estimated to take around 5 to 6 weeks of full time building and will include a full written specification of the invariants written down and argued, as well as a hard-kill gate writeup, which would provide the conditions under which the layer isn't needed and posted publicly. The design of Writ is already complete and this funds the first implementation. This round proves that it is buildable and the invariants hold in the running code with actual measured numbers. It doesn't prove adoption, and it is only one control primitive, not the entire answer to the issues presented.

Theory of Impact

Currently agents are being handed real-world authority faster than the security layer that binds it is created. We cannot trust in-model alignment (it is probabilistic) to be aligned with us and because deployers will inevitably over-trust these probabilistic model boundaries, a deterministic safety layer is required to exist. You cannot, and should not, make the LLM your entire boundary layer. Ironically this metering layer doesn't exist and is cheap to build. This project is applied AI control and containment, not alignment theory at all, this isn't relying on the agent to WANT to behave perfectly and it does not prevent agent compromise.

Writ provides bounds and timestamps what a compromised agent does. It focuses on making exceeding mathematically impossible and makes everything else provably bounded, detected, and attributable. While it could be argued that bounding on a small budget of a few hundred dollars is not an existential issue on its own, as agent capabilities scale, the stakes of delegated (implicitly trusted) authority will grow rapidly to critical infrastructure. Verifiable, deterministic limits, independent of the underlying model, are necessary to prevent rapid and unattributable real world harm.

People

Nathaniel Ryan Seals

Team Member

Grants Received– no grants recorded

Add grant

Funding Asks

grantmaking.ai Launch Round

Applied

Minimum

$12,000

Ideal

$50,000

What this ask is

Writ is a lightweight, deterministic security protocol that is crafted specifically to restrict and audit any real-world authority given to AI agents. This is a defense utility designed to ensure that when an agent fails or becomes compromised, the resulting damage is bounded, detectable, and attributable. It is a software layer that serves as a buffer between an agent and external systems it is allowed to use (financial APIs, cloud infra, databases, etc), not an alignment attempt.

Writ operates through three main mechanisms:

Deterministic bounds - Enforces hard limits on what an agent CAN do so that it cannot exceed its authorized budget.
Cryptographic Attribution - Every action the agent takes will be signed and logged into a registry that is tamper evident. This creates an audit trail of exactly what the agent did and when.
Fast Revocation - When an agent behaves unexpectedly its credentials can be revoked globally within a 50 second ceiling, effectively stopping it from doing anything further from that point.

I will be the only person involved for the majority of this project, with one independent reviewer brought in if the full budget is granted. This project is estimated to take around 5 to 6 weeks of full time building and will include a full written specification of the invariants written down and argued, as well as a hard-kill gate writeup, which would provide the conditions under which the layer isn't needed and posted publicly. The design of Writ is already complete and this funds the first implementation. This round proves that it is buildable and the invariants hold in the running code with actual measured numbers. It doesn't prove adoption, and it is only one control primitive, not the entire answer to the issues presented.

How the money will be spent

Because I am an independent researcher, the budget is mostly my time plus one external review.

Minimum ($12k): 5 to 6 weeks full-time building the core Writ reference implementation (capability tokens that only narrow, an append-only status log, epoch settlement, countersigned receipts) and a written spec of its invariants (no overspend under reservation, bounded revocation staleness, clean failure recovery).

Ideal ($50k) adds:

Core implementation + invariant spec + finalized paper: $12k
Benchmark harness measuring the design against a centralized-ledger baseline, turning the paper's hand-calculated performance numbers into measured ones: $10k
Revised prior-art analysis (AP2, UCP, Mastercard Agent Pay for Machines, Visa Trusted Agent Protocol, SCITT) and a public writeup: $8k
One independent adversarial review pass of the implementation and receipts: $10k
One quarter of maintenance, issue response, and public quarterly updates: $10k

All artifacts ship open and MIT on GitHub

Discussion

No comments yet. Be the first to share your thoughts.