Introducing aflock: package-lock.json, but for AI agents

An AI agent just deleted Trivy from GitHub. An autonomous bot exploited CI/CD workflows across major open source projects. No audit trail. No proof of what happened.

This is the problem we are trying to solve with aflock.

What is aflock?

aflock is a policy file for AI agents. The simplest mental model is: package-lock.json locks dependencies, while .aflock locks what an AI agent can do.

You define rules for tools, files, API access, and spending limits. That policy is cryptographically signed, so the agent cannot quietly rewrite it later.

Every action the agent takes produces a signed attestation. The agent never sees the signing key, so what you get is not just a log to trust, but verifiable proof of what actually happened.

Why not just use guardrails?

Guardrails are useful for filtering inputs and outputs, but they do not give you proof. They are not enough if you need auditability, compliance evidence, or post-hoc verification for agents running in production.

aflock is built around three ideas:

• Constrain: define what the agent can do with signed policy files.
• Attest: every important action produces a cryptographically signed in-toto attestation.
• Verify: validate compliance later with a multi-phase verification flow.

How it works in practice

Imagine asking an agent to analyze a customer database and prepare a board report. Reading the report file might be allowed. But if the agent tries to open db/credentials.json, exfiltrate data with curl, or write sensitive information to a public location, those actions can be blocked by policy.

In a real run you can see a summary like: 38 actions allowed, 4 blocked, and $3.12 of a $10 budget consumed, all with cryptographic evidence.

Identity matters too

aflock does not simply trust whatever identity the agent claims. It derives identity from the model, runtime environment, tools, and active policy. That means the identity is tied to verifiable properties, not just a string an agent reports.

Still early, but useful

aflock is still early and actively evolving. Right now it is available as a Claude Code plugin, but the design is agent-agnostic and fits any MCP-based setup.

Useful links:

• GitHub repository
• Paper
• Website
• Discussions