OrgKernel

OrgKernel

The Open-Source Trust Layer for AI Agents
Cryptographic agent identity, scoped execution, and tamper-evident audit trails —
transparent by design, not by promise.

3 Core Modules  ·  27 REST Endpoints  ·  PostgreSQL / MySQL / SQLite Persistence  ·  Works with LangGraph, CrewAI & AutoGen

The four questions

Every organization that deploys AI agents eventually asks the same four questions:

1. Who is this agent? → AgentIdentity — a cryptographic credential (Ed25519 keypair) signed by your Org CA
2. What can it do? → ExecutionToken — scoped, time-bounded permissions with tool allowlists and parameter bounds
3. What did it do? → AuditChain — an append-only, SHA-256 hash-chained execution log
4. Who authorized it? → the organizational authority chain — a verifiable lineage of who granted what

Agent frameworks help you build and orchestrate agents. None of them answer these questions. OrgKernel does — and because it sits in the execution path, it can't be bypassed. Governance is built into the engine, not left to the application developer.

Authorization is not a boolean — it's a graph

In a real organization, permission is never a single yes/no flag. A mission's execution permission is determined jointly by four layers — organization, department, role, and instance. Any layer's denial blocks execution.

Consider an agent that attempts to spend $10,000 to complete a task. The request is blocked — purchasing authority at that amount belongs to the department lead. With OrgKernel, the block is enforced at the token scope check, and the full context (which agent, which mission, what it requested, why it was denied) is already in the audit chain when the department lead asks what happened.

Read the launch announcement: Introducing OrgKernel

Part of Metaprise AURA

OrgKernel is the open-source trust foundation of AURA, the execution governance engine of the Metaprise Enterprise Agent Operating System. Every agent running on Metaprise — across banking, healthcare, insurance, and capital-markets deployments — authenticates, executes, and is audited through OrgKernel primitives.

You don't need Metaprise to use OrgKernel. It's a standalone Apache 2.0 Python library that runs entirely on your own infrastructure — no API key, no phone-home, no vendor lock-in. Inspect every line, audit the cryptography, fork it for your own stack.

What's in the box

Identity plus execution token together form the DualToken model: at execution time an agent presents both its organizational identity credential and an instance-scoped execution token. Both must validate before a tool call proceeds.

Upcoming capabilities (mission lifecycle, tool gateway, policy engine, authority graph, data classifier, SSO/SAML, SCIM) are tracked in the Roadmap.

Why OrgKernel

Key properties:

• Enforced, not advisory. Scope checks run before every tool call. There is no code path around them.
• Tamper-evident, not tamper-"proof by promise". Any deletion, modification, or reordering of audit entries breaks the SHA-256 chain and is detected by the integrity API.
• Least privilege by construction. Tokens carry only the tools and parameter bounds a single mission needs, and they expire.
• Compliance-grade evidence. The audit chain supports full replay of any agent's history and independent third-party verification — designed for the evidentiary requirements of financial, healthcare, and legal deployments.

System Architecture

…

Challenge-Response Authentication

Attack vectors prevented: Replay attack (nonce consumed after one use), private key theft (signature must match nonce), Token Grafting (token.agent_id == caller.agent_id verified at every scope check).

Three-Layer Audit Semantics

Security Model

Token Grafting Prevention

The Execution Token is Ed25519-signed by the Org CA covering the full payload (scope, bounds, expiry). Any modification invalidates the signature. The scope check verifies token.agent_id == caller.agent_id on every call.

Challenge-Response Authentication

Agents prove identity via Ed25519 challenge-response with one-time nonces. Certificates are verified against the Org CA's public key. Revocation and expiry are enforced at verification time.

Tamper-Evident Audit Chain

Every audit entry carries a SHA-256 hash of its content and a prev_hash linking to the previous entry. The integrity API recomputes all hashes and detects any deleted, modified, or reordered entries.

Quick Start

Install

Requires Python 3.10+. Install from source:

git clone https://github.com/MetapriseAI/OrgKernel.git
cd OrgKernel
pip install -e ".[postgres]"   # postgres | mysql | sqlite

Database driver extras: [postgres] — PostgreSQL (recommended) · [mysql] — MySQL / MariaDB · [sqlite] — SQLite for local dev.

Service layer

Direct Python async — no HTTP, no API key.

…

FastAPI integration

Mount the built-in HTTP router for 27 REST endpoints across identity, token, and audit.

…

Using OrgKernel with agent frameworks

OrgKernel is framework-agnostic: it wraps the tool boundary, so it works with LangGraph, CrewAI, AutoGen, or any custom agent loop. The pattern is always the same — check scope before the call, append to the audit chain after.

…

With LangGraph, wrap each tool node; with CrewAI, wrap each Tool's func; with AutoGen, wrap registered functions. Every agent action becomes identity-bound, scope-checked, and audit-chained without changing your orchestration logic.

REST API Reference

All endpoints are prefixed /orgkernel. No API key — the server is your own infrastructure.

Endpoint overview