Kepil Adds a Permission Layer to AI Agents That Actually Stops Them

Most AI agent frameworks give you logs after something goes wrong. Kepil tries to prevent the wrong thing from happening in the first place, then lets you roll it back if it does.

The open-source project, now in alpha, implements what its author calls an "accountability layer" for AI agents. The premise is simple: every agent should have an identity, a written set of permissions, a single enforcement point for all external actions, and a tamper-proof record of everything it did. Most existing systems cover one or two of these. Kepil attempts all four.

The timing matters. A 2026 survey from the Cloud Security Alliance found that 53 percent of organizations reported an AI agent exceeding its intended permissions. Nearly half of agents in production had no monitoring at all. Only 22 percent of respondents treated an agent as an entity with its own distinct identity. Those numbers point to a gap between how agents are built and how they should be governed.

Identity, Permissions, and a Single Door

Kepil gives each agent version an immutable passport: who built it, who runs it, what it does, what it will never do, its risk class, its autonomy class, and when its risks are due for review. A new version creates a new card. The old one stays around forever.

Each job gets a mandate, a machine-readable document describing allowed actions, allowed systems, spending limits, a validity window, and which actions require human confirmation. Anything not explicitly allowed is refused.

The gate sits between the agent and the outside world. Every action passes through it before a model is even called. If anything goes wrong during the check, the gate refuses the action rather than letting it through. Fail-closed, not fail-open.

A key design choice: Kepil will not let you create an agent with full autonomy. The AgentPassport class rejects construction if the autonomy class reaches a point where a human can no longer cancel a decision. This is a deliberate architectural limit, not a missing feature, and the gate enforces it regardless of what a profession definition claims.

An Append-Only Journal You Can Verify Someone Else Wrote

The journal is an append-only JSONL file where every record carries the hash of the previous one. Editing or deleting a record breaks the chain. The interesting part: verification happens through a separate implementation in another language, agent-trace. Kepil's own author checking its own journal is not proof. An independent verifier is.

The journal records types, counts, and hashes, never values. State is stored as plain JSON files under a configurable data directory. No database, no external services. You can open the files, read them, and attach them to a dispute.

Undo That Stops Honestly

The journal forms a graph of actions, and every profession definition declares a compensating action for each step. When you ask Kepil to undo, it walks the graph backward from the last action toward earlier ones, stopping at the first step that cannot be reversed. It tells you where it will stop before you press the button.

The undo runs as an operator's decision, recorded in the journal. Neither the MCP server nor the JSON API can initiate a rollback on its own. An agent undoing its own actions would be signing in someone else's name.

Integration Without Trust

Kepil ships an MCP server with seven tools: list professions, create an order, run a step, read order status, see pending human confirmations, verify the journal, and read an agent passport. One tool is deliberately absent: confirmation. If a model could approve an irreversible action, the human would drop out of the chain. The confirmation card goes to a person, in the admin panel or in Telegram, and no MCP client can press it.

A JSON API lets external automation, n8n workflows, Make scenarios, or custom scripts, ask permission before acting. The API is disabled by default until you set an authentication token. Responses include a reason field explaining the decision, and everything gets recorded in the journal so you can later show on what grounds the automation did or did not act. A ready-made n8n node exists: n8n-nodes-kepil.

Irreversible actions can be sent to Telegram with approve or return buttons, so accountability does not require sitting at a laptop.

Professions as Data, Not Code

An agent's job is a JSON description: ordered steps, boundaries, limits, irreversible action patterns, and rollback rules. Adding a new kind of work means adding a file or filling in a form in the panel. Five professions ship with the project: inbound leads, process automation, bookkeeping documents, AI-adoption audit, and public-procurement packages.

Documentation requirements vary by country and change faster than code, so compliance texts live outside the engine. The neutral pack follows international practice, including ISO/IEC 42001. Jurisdiction-specific packs, such as one for Kazakhstan's AI Law No. 230-VIII, can be dropped into a packs directory.

Zero Dependencies and a Hard Rule About Supply Chain

The core runs on the Python 3.11+ standard library. CI fails the build if a third-party import appears. This is not a preference. The tool sees every action an agent takes, so the supply-chain attack surface must be zero. It also makes Kepil installable inside air-gapped environments where external packages are not an option.

The project has 115 tests and is at alpha stage, meaning interfaces may still change. Licensed under AGPL-3.0-or-later, running a network service built on Kepil requires releasing your source under the same terms or purchasing a commercial license.

Related projects include agent-trace for independent journal verification, AI-Gateway for PII and secret masking between applications and external models, and AutoGov for discovering shadow automations and the credentials they can reach.