Feature explainer
The core set stays focused: session scope, pre-execution decisions, controlled surfaces, containment, evidence, and fail-closed assurance.
Control
Feature
Actions are checked before the target system changes.
The request is evaluated against actor, target, action type, scope, policy, and state.
The agent asks to write a note. SUPEREGO checks whether that write is allowed for this session.
request -> check -> permit_or_denyFeature
Authority is tied to a session or project instead of becoming permanent access.
The Agent Session Agreement carries allowed tools, resources, action types, expiry, and revocation rules.
A care assistant can read a scoped chart during this review, but cannot keep using that access later.
session_scoped -> expires_on_disconnectFeature
An approved action gets a narrow pass. The pass is not reusable general authority.
The permit is tied to the actor, request, action, target, scope, and expiration.
Permit one ledger update. The agent cannot spend that permit on shell access or a different record.
permit: graph.write · one_useFeature
Access can be cut off when the session ends, trust changes, or an operator intervenes.
The agreement lane closes and future requests fail unless a new scope is approved.
A contractor agent loses write access after the review window closes.
agreement.revoked -> no_new_permitsConnect
Feature
Agents get controlled tool routes instead of unmanaged direct tool authority.
MCP and API calls become structured requests that pass through the decision layer.
A Claude or Codex MCP client routes through SUPEREGO instead of raw local tools.
mcp.tool -> governed requestFeature
The agent receives governed handles, not raw paths, keys, or unlimited tool access.
A handle points to a controlled route where every action still needs a decision.
A file handle can request one read without exposing the whole folder as ambient context.
handle:file.report -> file.read requestFeature
Agents should not receive raw standing keys just because they need to act.
Approved actions execute through a controlled path while credentials stay behind the boundary.
The agent asks to update a ticket. It never sees the service token used by the connector.
no_raw_token_to_agentFeature
SUPEREGO also watches for routes that try to avoid the authority layer.
Unmanaged MCP, raw credentials, direct API egress, and non-governed registries are tracked as outside-path risk.
An unregistered MCP server appears. The console marks it as unmanaged risk.
mcp.unmanaged -> outside_pathAudit
Feature
Operators can see allowed, denied, reviewed, and escalated actions as they happen.
The console displays active agreements, current permits, decision feed, and policy state.
graph.write is authorized, phi.export is denied, unmanaged MCP is flagged.
authorized · denied · outside_pathFeature
Reconstruct the path from request to decision, permit, denial, receipt, and proof hash.
Each event carries structured evidence to review the authority path later.
An auditor can see that an export never received a permit and never executed.
request -> denial -> zero-op receiptFeature
Share the decision trail without copying raw private content into the export.
The export emphasizes metadata, decisions, hashes, receipts, and outcomes.
A review package can show the denial without including the patient note or private prompt.
hash_only · no_raw_contentFeature
The system can show that a decision happened and what authority was granted or refused.
Permits, denials, receipts, and hashes are recorded as decision evidence.
A reviewer can see that a request was denied without trusting the agent's response text.
decision_hash · permit_subject · receiptAssurance
Feature
If the authority path cannot evaluate the action, no action is authorized.
Missing policy, expired session, invalid permit, or unavailable authority state blocks execution.
If SE Host is unavailable, the agent cannot fall back to raw tool execution inside the governed path.
authority_unavailable -> denyFeature
Denied actions produce evidence that no governed execution occurred.
The denial receipt records the request facts, reason, timestamp, and zero-operation outcome.
A blocked export receives a signed denial and a receipt showing no export handler ran.
deny -> zero_op_receiptFeature
The execution claim is checked against an independent view of what changed.
A custody watcher compares the permit, adapter claim, and observed state change where the local alpha can model it.
A read-only permit cannot be quietly reported as safe if the observed result shows a write or deletion.
permit.effect == observed.effectFeature
Authority and evidence stay scoped to the tenant, project, or protected demo environment.
Decision artifacts include tenant and session binding so proof from one environment cannot authorize another.
A local alpha proof can be reviewed, but it cannot become production authority for a different customer tenant.
tenant_id + session_id + proof_hashNext
Start with an agreement, then open the console to inspect requests, permits, denials, receipts, and replay.