An Agent Behaviour Policy says what one agent may do. Until now, what kept each rule was the agent's own willingness, a hook on its own machine, or a control you already ran. SHarness adds the missing piece: an open-source secure harness, which RiskMandate maintains and you run in your own environment, that turns the ABP into a policy the Linux kernel holds on every process the agent starts. We are still never in the request path.
An ABP describes; a Process Behaviour Policy is that description executed, underneath the agent. In sharness.ai's own words: “An ABP describes an agent's behaviour; a PBP is that description executed, underneath the agent.”
Before
RiskMandate wrote down the reach, the mandate, the gap and the barrier on every row. Most barriers were expectations, lines the agent reads, or settings it could switch off. Enforcement was yours to find.
With SHarness
The same rows, compiled into a policy named by a hash you supply, and held by something the agent does not include: the kernel, or a door that is the only way to a resource. A row held that way is a boundary, the one kind of barrier an insurer, an auditor or a board can count.
Not inline, still: “The enterprise story has no product in the request path.” The vendor ships profiles, your organisation names its own proxies and databases, the machine compiles the rest, and “it costs nothing per request: the expansion runs once, at launch.” From SHarness: the secure harness we could not find, so we built it, 29 October 2026.
02 · How a rule gets held
Three things make a policy binding.
The text. A small JSON policy in canonical form, so it hashes the same in every language.
The hash, from outside. You supply sha256:…, and the enforcer refuses anything else. “A prompt-injected agent cannot widen what it cannot rename.”
An enforcer the agent does not include. The kernel, or a separate process. “Who enforces decides the barrier kind.”
A launcher outside every domain checks the hash, gives each part its own Linux user and certificate, and destroys the certificate authority's key. The kernel holds the capability rows: what a process may read, write, run and connect to. Five doors hold the behaviour rows, each the only way to one resource: files, network, keys, shell and model. The permission prompt goes last: “yes to what the policy allows, silence for what it refuses, and a question only for what it cannot hold.”
03 · The offer, step by step
Describe, check, hold, and show the evidence.
1 · Describe
The ABP
One agent, one deployment: reach, mandate, gap and the barrier on each row. Available now, from the pack to a reviewed and signed policy. The levels.
The same rows, held by the kernel and the doors, in your environment. Open source, Apache-2.0: pip install sharness-ai. We help you deploy it.
4 · Show
Two numbers
Every summary carries the reach nobody asked for, and now a second number: the rows no boundary holds. “The second number is the business case for the next door.”
04 · Status, as at 29 October 2026
What runs today, and what is still the design.
sharness.ai labels itself a design with its first experiments runnable, and keeps the honest column. This is ours from it.
Runs today
sharness-ai 0.2.0 on PyPI: Python standard library only, 243 tests.
The kernel locks on a process: file and execute rules, ports, no network, memory and process caps, the hash checked first.
hello: six probes under a deny-all policy, six held, in five environments, one of them a Linux kernel in a browser tab.
The levels: contain, profile, explain, from one sentence down to the kernel.
The file and network doors, as early versions, and a shell whose only way out is the network door.
Design, not built
The launcher above the agent. In the project's words: “Nothing yet binds the agent itself.”
The key, shell and model doors; seccomp; hostnames in the policy.
Linux only, and no protection against root.
policy translate writes the same policy for bubblewrap, Docker, Kubernetes and Claude Code's sandbox, with what each cannot hold; the translations have not been run against those targets.
The security reviews so far were done by an agent of the project.
05 · For the technical reader
The questions a sceptical engineer asks.
Is RiskMandate now inline?
No. SHarness runs on your machine, in your cluster or your cloud, started by you, and checks nothing per request with us. RiskMandate writes and maintains the policies and the harness; it holds no key and sees no traffic.
Does it replace my sandbox or gateway?
No: it is a reference implementation, and any environment that holds the same rows is a valid enforcer. policy translate writes the policy for the tools you run and lists what each of them cannot enforce. The enforceability matrix.
What is the false-positive rate?
There is none to give: most of it is a design. The argument is that a policy layered down to the business (network, then database, then tables, then field ranges) knows what the application is for, and that CI should fail when the footprint grows without a policy change. False positives and the harness.
Can I try it now?
In a browser tab, with nothing installed: the playground, or a Linux kernel booting in the page, about two minutes. On Linux, in a virtual environment: pip install sharness-ai, then sharness-ai hello.
What does it want from you?
Feedback: run hello, try to break the shell, and say who should run the launcher in your organisation.