Trust, earned.

Mohar watches what an AI agent does, checks whether the result was right, and turns that record into permission, one capability at a time. One wrong move on a gated capability and the right is gone. Every decision is sealed with a receipt.

Watch an agent earn it Install the CLI

A seal stamp with a carved rosewood handle and an engraved octagonal brass die, standing on an old manuscript page

Tilt the stamp with your pointer. Click it, or run the agent below, and it presses a receipt.

Approval prompts stopped working

agent wants to run
  Bash(npm run migrate -- --env=prod)

Allow this action?  [y] yes   [n] no   [a] always
> y   approved in 0.8 s, prompt 41 of 44 today

mohar decide, same action
  capability   db.migrate.prod   (gated)
  level        ask first
  record       3 verified passes, 1 failure 6 days ago
  result       escalate to the database owner
  receipt      #4183  sha256:a681d4e7fbebe401f4fcedec443476f9a7db7598379b2a2c5d03ec5acb87726d

93%

of Claude Code's manual permission prompts are accepted. Anthropic, March 2026

16 min

to the first critical failure, median, when Zscaler's red team attacked enterprise AI systems. Zscaler ThreatLabz, January 2026

People approve almost everything, and the systems they approve break fast. Mohar asks less often, and only about actions an agent hasn't earned.

Run an agent for a week

Mohar's rules, running in your browser. Each task is checked by tests, never by the agent's opinion of itself. Receipts form a real SHA-256 chain; the browser demo has no keys, so it doesn't sign them.

One decision, four steps

Instant

As long as your tests take

Instant

Instant, or a person

Record: The action goes into a local hash-chained log, signed by a key the agent never sees.
Verify: Tests, a diff, a replay or a person accepting the work decide the outcome. A model grading itself never counts.
Score: Per capability. Hard gates sit outside the score.
Decide: Inside earned limits it runs. Outside them it goes to the right person, with the agent's history attached.

What a receipt proves

{
  "v": 1,
  "seq": 4182,
  "prev": "sha256:8c2b54873548a6358134041eb1b70b662bf30058c50d44534d2f3eba4c210115",
  "ts": "2026-10-14T14:22:07.311Z",
  "agent": { "id": "agent:claude-code/laptop/7c1e",
             "key": "ed25519:0310b053afb12114a1eeda05a0bcfd29fa0930c33ce58312a9c4507a3e1df2ec" },
  "authority": [{ "principal": "human:7f3a09c2",
                  "granted": ["fs.edit.*"] }],
  "action": { "capability": "fs.edit.tests",
              "args_sha256": "c10c93a636daab9349a97f46f6e8a34c1c778b62781d36c0c1496a725d468044" },
  "decision": { "result": "allow", "level": 1,
                "wilson_lower": 0.83, "n": 14 },
  "verification": { "kind": "tests", "result": "pass" },
  "sig": "ed25519:f7842b523255408873f8df403cefdac5d3fa11eed4c5e05eec0eb60eb2c7e67a551fa089e47bf8a8f52e5f41bc1a2b294d0fefa377a30df793b1de2d981ababf"
}

The hash of the receipt before this one. Change or delete any receipt and every later one stops matching.

authority

Who handed this agent its rights, by pseudonymous ID, so the log holds no names. Each link can only narrow what it received.

args_sha256

The exact action. A person's approval is bound to this hash, so a different action can't run under it.

decision

Why it ran: the level on this capability and the evidence behind it.

$ mohar verify
broken: receipt 4182: BadSignature
$ echo $?
1

Edit one byte of a receipt and the chain names it. Delete receipts from the end and the last checkpoint says how many are missing.

sig

Ed25519 over the RFC 8785 canonical bytes. mohar verify checks every one, a million in about eight seconds.

The planned full format. The receipt log and its CLI ship today with the fields in the format reference; the full field list is in the design.

How trust moves

Ask first

Every action goes to a person.

The start, and where any gate violation or high-risk failure sends an agent.

Supervised

Low-risk reversible actions run; 20% are sampled for review.

10 verified outcomes, a 95% Wilson lower bound of 0.80, and 7 days at the level below.

Trusted

Actions run inside the capability's gates; 5% are sampled.

30 verified outcomes and a lower bound of 0.95. Never for high-risk irreversible capabilities.

Five passes out of five give a lower bound of about 0.57, so a lucky streak promotes nobody. Evidence fades with a 30-day half-life. Demotion is immediate; promotion always waits. These are starting values for the benchmark to test. Read the full design

Sits beside what you run

Planned seams, in order of strength. Each is described in Integrations.

Claude Code hooks

MCP servers

awslabs CAO

Google ADK

Microsoft Agent Governance Toolkit

Paperclip

OpenAI Codex

A2A agents

Seal your first receipt

The receipt log and the mohar CLI shipped in 0.1, for Linux, macOS and Windows. The trust engine is next. Nothing is production-ready yet.

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/harshitwandhare/mohar/releases/latest/download/mohar-cli-installer.sh | sh

Read the install guide Read the roadmap