Personal research project · not a commercial product

Governance for AI agents,
without the vendor lock-in.

Open extension·Not a walled product

Scout is a research project building a decision-provenance layer for AI agents: an open extension to an existing sandbox platform, not a product tied to one agent vendor.

See the roadmap What it is
Open-source base
Agent-agnostic
Evidence, not just logs
What it is

An extension, not a reinvention

Rather than building a new sandbox for AI agents from scratch, Scout extends an existing one, so the governance layer doesn't depend on reinventing the hard parts that are already solved.

Scout extends NVIDIA OpenShell, an open-source (Apache 2.0) sandbox and gateway for AI agents that already supports several different agent harnesses out of the box.

Scout registers as an extension inside OpenShell's own decision path. Whenever an agent tries to cross a boundary (create a sandbox, attach a tool, reach a network service, pick up a credential), Scout is one of the things asked, and the thing that remembers what was decided and why.

  • Built on NVIDIA OpenShell (Apache 2.0, open source)
  • Operates at the sandbox / network / credential boundary
  • Not a new agent framework, and not an enforcement rewrite
  • Adds durable decision records and consequence linkage
Who it benefits

What it's for

Most AI agent safety tooling is wired into one specific agent framework: swap the agent, lose the governance. Scout's layer sits underneath that choice.

Portability

The same governance and evidence layer keeps working even if the agent running inside it changes, because it's built on a substrate designed to support more than one agent, rather than hooks specific to a single vendor.

A real answer to "why was this allowed?"

Enforcement alone only tells you a boundary was blocked or allowed. Scout keeps a durable, queryable record of the decision and links it to what happened afterward, so a review can ask "which decision let this happen," not just "what happened."

How it works

Where Scout sits

The sandboxing and enforcement itself (who's allowed to do what, signed policy, credential handling) is OpenShell's job, and it's already solid. Scout's own contribution is narrower and specific.

01Agent
02Sandbox boundary
(enforced by OpenShell)
03Scout evaluates &
records the decision
04Evidence store
05Linked to what
happened next

General-purpose enforcement tooling doesn't keep this history around. Scout's job is durable decision provenance, and tying a decision to its real-world consequence.

The research question

What's actually being tested

Stated plainly: can a decision-provenance and consequence-linkage layer be added to an existing agent-governance substrate without forking it, while staying provably independent of any specific agent? That's the falsifiable claim this project is testing, not a finished result.

This sits next to existing work rather than instead of it:

  • OpenShell already enforces sandbox boundaries with signed policy. It doesn't keep a durable, queryable record of why a boundary was drawn, or link it to what happened next. That gap is this project's focus, not a rebuild of enforcement.
  • ERC-8004 / 8126 style standards address a different question: an agent's own cryptographic identity and reputation, verified on-chain. That's about who an agent is, not why a particular boundary decision was permitted.
  • General-purpose LLM guardrails filter prompts and outputs at the content layer. Scout operates one layer down, at the sandbox and credential boundary, and has no view of message content at all.
Roadmap

Where this is going

A roadmap, not a changelog: nothing below is claimed as finished until it's been verified.

1 Confirm the baselinein progress Verify exactly what OpenShell already provides for free, so Scout only builds what's genuinely missing rather than duplicating it.
2 Register the extensionplanned Stand up Scout as a real OpenShell extension service, answering both the control-plane and data-plane contracts, inside OpenShell's own latency budget.
3 Durable evidenceplanned Record boundary decisions in a permanent, queryable store (not just a log line) without slowing down the decision path itself.
4 Consequence linkageplanned Connect a decision to what the agent actually did afterward, so an incident can be traced back to the decision that permitted it.
5 Prove agent-independenceplanned Run two genuinely different agent harnesses against one unmodified Scout service and confirm the same policy produces the same verdicts: the real test of "works with any agent," not just a design claim.
6 Security review and write-upplanned A proper threat-model pass, then a public research write-up.

A fuller research write-up is in progress.

Get in touch

If you'd like to discuss the research, reach out directly.