Live Enforcement Demo

Let me walk you through this page. SovereignClaw is a control layer that sits between an AI agent and the systems it wants to touch. The agent can propose an action, but it cannot take one. Every proposal is checked, decided, and signed before anything is allowed to happen.

On this page you are driving a live SovereignClaw gateway from your browser. Each of the six buttons sends a real request to the gate. The gate makes a real decision, signs it with its own key, and writes it into a tamper-evident ledger. Nothing here is a recording.

Here is how a decision is made. The request is written down in a fixed form and frozen, so it cannot change after the check. The gate works out the risk facts on its own instead of trusting the agent's description. It sorts the action into a tier, from tier zero for observing up to tier three for the most dangerous operations. Then it allows, holds for a human, or refuses, and hands back a signed receipt chained to the one before it. Pick a scenario and I will explain what you see.

This one lists the files in a log folder. Reading is low risk, so the gate allows it at tier zero on its own, and it still signs a receipt. Even a boring action leaves evidence, and that evidence is what an auditor checks later.

Here the agent writes an application config file in staging, and it describes the risk honestly. The gate's own view of the facts matches the agent's, so this is a normal change with a normal receipt at tier one. Nobody needs to be woken up for it.

Now the agent asks to restart the production payments service. That is an elevated action, tier two, and elevated actions need a signature from a human approver. The agent does not have one, so the action cannot proceed. The refusal is signed as well, so the attempt itself is on record.

This is the one to linger on. The agent asks to download a script from the internet and run it, but labels it as a harmless read. The gate ignores the label. It infers the facts itself, finds several that contradict the agent's story, and refuses. The agent's description of its own risk does not get a vote.

Here the agent is honest. It asks to delete the production Kubernetes namespace and admits how dangerous that is. Honesty does not help. Destroying production infrastructure sits at tier three, a floor that nothing in the request can lower. There is no path to execution, only a signed refusal.

Finally, the page resends the last approved request byte for byte, the way an attacker would. An approval is single use. The ledger already holds a receipt for those exact bytes, so the gateway refuses to mint a second one and points back at the original. Copying yesterday's permission slip does not work.