BRbrian_r_hall·May 5, 2026Submission
Agent guardrails are mostly theater
3 points · Open discussionfaramesh
faramesh-core
Go2026–2026
faramesh / faramesh-core
faramesh-core
Governance-as-Code for AI agents. Declarative constraints with deterministic enforcement. Provisioning Identity, Tool-based rules, Brokering Credentials & Ensuring safe deployment
2Distinct people
5Mentions
0Explicit recommenders
111GitHub stars
What to know before exploring
What it is
Governance-as-Code for AI agents. Declarative constraints with deterministic enforcement. Provisioning Identity, Tool-based rules, Brokering Credentials & Ensuring safe deployment
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by week5 dated mentions
Observed mentions: 2026-01-21 22:00:44 UTC to 2026-05-05 15:27:07 UTC. Weeks start Monday, UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Jan 19 | 2026-01-19 00:00:00 UTC | 2026-01-26 00:00:00 UTC | 4 | 2 | 2 |
| Jan 26 | 2026-01-26 00:00:00 UTC | 2026-02-02 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2 | 2026-02-02 00:00:00 UTC | 2026-02-09 00:00:00 UTC | 0 | 0 | 0 |
| Feb 9 | 2026-02-09 00:00:00 UTC | 2026-02-16 00:00:00 UTC | 0 | 0 | 0 |
| Feb 16 | 2026-02-16 00:00:00 UTC | 2026-02-23 00:00:00 UTC | 0 | 0 | 0 |
| Feb 23 | 2026-02-23 00:00:00 UTC | 2026-03-02 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2 | 2026-03-02 00:00:00 UTC | 2026-03-09 00:00:00 UTC | 0 | 0 | 0 |
| Mar 9 | 2026-03-09 00:00:00 UTC | 2026-03-16 00:00:00 UTC | 0 | 0 | 0 |
| Mar 16 | 2026-03-16 00:00:00 UTC | 2026-03-23 00:00:00 UTC | 0 | 0 | 0 |
| Mar 23 | 2026-03-23 00:00:00 UTC | 2026-03-30 00:00:00 UTC | 0 | 0 | 0 |
| Mar 30 | 2026-03-30 00:00:00 UTC | 2026-04-06 00:00:00 UTC | 0 | 0 | 0 |
| Apr 6 | 2026-04-06 00:00:00 UTC | 2026-04-13 00:00:00 UTC | 0 | 0 | 0 |
| Apr 13 | 2026-04-13 00:00:00 UTC | 2026-04-20 00:00:00 UTC | 0 | 0 | 0 |
| Apr 20 | 2026-04-20 00:00:00 UTC | 2026-04-27 00:00:00 UTC | 0 | 0 | 0 |
| Apr 27 | 2026-04-27 00:00:00 UTC | 2026-05-04 00:00:00 UTC | 0 | 0 | 0 |
| May 4 | 2026-05-04 00:00:00 UTC | 2026-05-11 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
5 sourcesSpot on, Yaron. Schematic validation (Protobuf) catches structural errors, but semantic aliasing (the 'rm -rf' vs 'rm -r -f' problem) is exactly why I developed the CAR (Canonical Action Representation) spec.
I actually published a 40-page paper (DOI: 10.5281/zenodo.18296731) that defines this exact 'Action Authorization Boundary.' It treats the LLM as an untrusted actor and enforces determinism at the execution gate.
Faramesh Core is the reference implementation of that paper. I’d love for you to check out the 'Execution Gate Flow' section. it would be a massive win to see a Faramesh-Cordum bridge that brings this level of semantic security to your orchestrator.
Code: https://github.com/faramesh/faramesh-core
In Ask HN: How are you handling non-probabilistic security for LLM agents?Show HN: Faramesh – A deterministic gate for stochastic Autonomous AI agents
I spent the last few months watching LLM agents "vibe-code" their way into production disasters. We’ve been pretending that a 500-word system prompt is a security layer. It isn't. It's just a polite request that the model is one jailbreak away from ignoring.
I built Faramesh because I wanted a hard, cryptographic boundary between the agent's "brain" and my actual infrastructure. It intercepts tool-calls and forces them through a deterministic gate before any code runs. If the action isn't in your policy, it simply doesn't exist.
The biggest headache was canonicalization.py. LLMs are messy—one model sends a float as 1.0, another as 1.00, and it breaks the cryptographic hash every time. I wrote a normalization engine to ensure that identical intent produces the exact same byte-stream and hash.
It’s open source (Python/Node SDKs). I’m curiou
Read the rest
s if people think this should live at the framework level or as a standalone proxy. Tear the code apart:
https://github.com/faramesh/faramesh-core
For theory lovers, I'd invite you to read a paper i published just recently titled "Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent systems" (Link below)
https://doi.org/10.5281/zenodo.18296731
Faramesh – The first deterministic execution control plane for AI agents
1 points · Open discussionThe problem with autonomous agents today isn't that they aren't "smart" enough; it’s that they are fundamentally stochastic, while our infrastructure (SQL, APIs, Shell) is deterministic. You are essentially giving a probabilistic model a direct line to your production environment and hoping "system prompts" act as security. As we found out in 2025, prompts are not a security layer. You cannot safely give a probabilistic model a "delete" key and hope the instructions hold.
We built Faramesh to bridge this gap. It is the first formalized Action Authorization Boundary (AAB) for the agentic web—an open-source, protocol-agnostic execution gate designed to sit between an agent’s reasoning engine and the target system.
In 2025, everyone focused on the "Brain" (the model). In 2026, the bottleneck is the "Nervous System" (execution control). The i
Read the rest
ndustry is shifting from Model-mania to Infrastructure-mania; we believe agents shouldn't be "trusted"—they should be governed.
How it works: Unlike existing guardrail libraries that use more LLMs to "check" the first LLM (adding more stochasticity), Faramesh introduces a hard, cryptographic gate. It intercepts agent intent, canonicalizes it into a deterministic byte-stream, and validates it against a strict, logic-based policy engine before any code is executed.
Key Technical Details:
- Deterministic Canonicalization: We found that slight variations in JSON or float representation break audit trails. Faramesh handles lexicographical sorting and float normalization (e.g., ensuring 1.0 and 1.00 produce identical bytes) so that identical intent produces identical hashes.
- The AAB Protocol: This defines what an agent is allowed to do across any medium. Whether targeting REST APIs, gRPC, or raw Shell, the control logic remains the same.
- Zero Trust Execution: The agent never touches the target system directly. It sends a "Proposed Action" to the gate. If the engine is confused or a policy is missing, it fails closed and the action is blocked.
- Cryptographic Hashing: Every authorized action is hashed, creating an immutable, replay-protected audit trail of agent intent.
- SDK-First Integration: We’ve released SDKs for Python and Node.js to make this a drop-in layer for existing LangChain/AutoGen stacks.
We’ve open-sourced the core engine and the SDKs. We’re particularly interested in feedback on our canonicalization logic and the policy engine’s performance overhead.
Paper: https://zenodo.org/records/18296731
GitHub: https://github.com/faramesh/faramesh-core
PyPI: pip install faramesh
NPM: npm install @faramesh/sdk