Pre-execution authorization layer for Hands — a gap worth naming

Description

OpenFang’s approval gates (e.g. Browser’s purchase confirmation) are well-designed — but they’re evaluated inside the agent’s execution context. If the agent is prompt-injected or hallucinates before the gate fires, the gate itself can be compromised.

There’s a pattern emerging in agent security called pre-execution authorization: a cryptographically signed clearance issued before an action executes, enforced by a layer that lives outside the agent’s reasoning context entirely. The agent can’t reason its way past it.

The Sigil Open Framework (SOF) is an open standard for this. There’s a native Rust crate — sigil-agent-hooks-core — that hooks into a PreToolUse interceptor and issues an Ed25519-signed Intent Attestation before any tool call fires. Given you’re already using Ed25519 for manifest signing, the model should be familiar.

Not suggesting replacing any of your 16 layers — this sits upstream of them. Worth a look if governance and auditability become a priority as Hands mature.

→ sigilcore.com / github.com/Sigil-Core/agent-hooks-rs

Alternatives Considered

No response

Additional Context

No response