Role
A versioned description of work: intent, authority, discretion, evidence duty. Inert until granted. The shareable unit.
Trust layer for delegated work
Install a trustworthy
function, not a bot.
cage lets an organisation hand real work to software roles and stay in control: bounded by authority, tempered by discretion, and answerable through evidence.
- Bounded
- Legible
- Observable
- Answerable
evidence
committed before effect
{
"seq": 41,
"role": "ap-reviewer@2.3",
"assignment": "asg_7fa1",
"owner": "finance",
"authority": ["ledger.read", "invoice.propose"],
"discretion": "act-with-approval",
"effect": "invoice.approve",
"approved_by": "owner",
"decided_at": "2026-10-22T09:14:07Z",
"hash": "9c1f…e2a4"
}01 — The gap
Intelligence is no longer the bottleneck. Trust is.
Agents can already do the work. What stops them is that no one can say precisely what they were allowed to touch, how far they were allowed to decide, or what they actually did.
- Ambient credentials. The agent holds a key, so it holds everything the key opens.
- Unbounded reach. Nothing structural separates a read from a push.
- Logs after the fact. A trail you cannot verify is a story, not evidence.
02 — The model
A role is a promise.
An assignment makes it real.
Assignment
The grant: an accountable owner, a budget, a TTL, and a context. The unit that acts — not the actor.
Evidence
The append-only warrant of every effect, hash-chained and signed, written before the irreversible.
Authority
What may be touched.
Nothing not granted is possible. Capabilities exist only through an assignment; there are no ambient credentials.
Discretion
How far it may decide.
- observe
- advise
- draft
- act with approval
- act with notice
- self-directed
Two independent axes, resolved per capability. The same actor can be self-directed on low-stakes work and approval-only on the irreversible.
03 — Isolation
Enforcement where the actor cannot reach.
The actor is untrusted by construction: it holds no credential and has no path to a system. Control and enforcement are separate — a policy decision point decides; enforcement points act.
Isolation is a tier, selected per role and failed closed. A tier the cluster cannot provide refuses the run rather than quietly downgrading it.
- runc Namespaces and cgroups. For the trusted platform itself, never for untrusted work.
- gvisor A user-space kernel interposes every syscall. The fallback when hardware virtualisation is absent.
-
kata
A microVM per run with its own kernel, on
/dev/kvm. The default for delegated work.
A root-in-guest actor cannot reach the policy that governs it. Network enforcement lives at the node and CNI, not inside the sandbox.
04 — Evidence
The record is written
before the act.
Irreversible effects are committed to a signed ledger first. The record carries the role version, the assignment, the owner, the decision, and the basis it was made on.
Records chain by hash. A stranger can verify the whole warrant against the owner’s public key, offline, without trusting the operator.
- Pre-effect commit authorised before it happens
- Hash-chained tampering is detectable
- Portable verify with a file and a public key
- Owner-attributed no authority without an owner
05 — The loop
From intent to audited effect.
- 01
Describe the role
Intent, authority, discretion, and what evidence it owes. Versioned, reviewable, inert.
- 02
Grant an assignment
Name the owner, set the budget and TTL. The grant carries the trust, not the model.
- 03
Run it bounded
Each run gets its own microVM, its own network identity, and only the credentials its role declares.
- 04
Verify the evidence
Every effect is recorded before it lands. Verify the chain offline, hand it to an auditor, or export it.
06 — Access
Put a trustworthy function to work.
We are working with a small number of teams on real operational roles. Tell us what you want to delegate.