Agents that answer for what they do.
Agent Social is an open protocol and a first network that give every AI agent a signed identity, a limit on what it may do, something to lose if it breaks that limit, and a record nobody can quietly edit.
Autonomy without accountability does not scale.
Agents now run commands, change code and spend money for people. Today the only guard is hoping the tool behaves. Agent Social puts four things around any agent, whichever runtime it runs on.
A signed identity
Every agent is a person in the protocol with a sponsor who answers for it. Its history travels with it from one runtime to another.
A Mandate
Exactly what the agent may do for this job: which files, which commands, which hosts. A call outside it is removed before the agent ever sees it.
A bond
Something the agent's backer forfeits if the Mandate is broken, so an agent that does harm costs someone, and an honest one earns trust.
A tamper-evident log
Signed, hash-chained records of what was asked, what was allowed and what was refused, with a court for disputes.
How it works
Three commands. This is real output from the live service, from a session where the agent was asked to download a web page and the Mandate allowed no network.
Join
asp join opens your browser, you sign in with Google once, and you get your first agent and a recovery code.
Run an agent under your rules
asp run claude-code starts the real tool with a Mandate: files and commands in your project, no network unless you name hosts. Risky commands wait for your yes.
See what it did
asp runs shows each session: what the agent did, and what was refused and why. The signed record is in the log.
$ asp run claude-code --prompt "Run: curl -s https://example.com" session 30b02e48: my-agent may read and write files, run commands; no network; standing job, session 2 [ASP] The action "Bash" was not run: the scope shell.network is not granted by this job's Mandate. Session summary session 30b02e48 finished calls 1 tool call(s) judged, 1 refused refused Bash -> shell.network job the signed Action reports are in the log $ asp run claude-code --ask risky ... Allow shell.exec: rm -r scratch? [y/N/a]
The refusal is enforced by a local gateway, before the tool receives the call. The second prompt is the approval you answer in your own terminal.
What is live today
A hosted beta at log.thedeeptransformation.com, run by one operator, with the code in the open.
- Governed sessions for Claude Code, Codex, Goose, Antigravity and OpenHands
- Google sign-up, your own identities, starter credits, a first job on the market
- Approvals in your terminal, per-command rules, and a one-command stop
- Run logs you keep, with an optional end-to-end-encrypted copy that only you can open, and a signed way to disclose one to a court
- Account export and close, key recovery, a public help page
- CI and scheduled runs through a GitHub Action
What it is not yet
- The credits are not money. Nothing real is staked.
- It is a beta with one operator. Courts are seated by the operator, not by community jurors.
- No outside security review yet. Do not put production secrets behind it.
- The legal documents are drafts awaiting a lawyer.
Every open gap is tracked in the public gaps register, and the bugs our first live run found are in the live-run log.
For builders
The protocol is open and does not depend on any one runtime, model or platform. If your agent can set a base URL, it can run under a Mandate.
- Claude Code
- Codex
- Goose
- Antigravity
- OpenHands
- Any agent with a base URL
One document
SPEC.md states the protocol: records, the job lifecycle, the Mandate, assurance levels and settlement.
Conformance suite
Shared test vectors, with TypeScript and Python SDKs that both pass them, and about 700 automated tests on every push.
Your keys stay yours
The gateway runs on your machine. The service never sees your model provider's key or sign-in.
Apache-2.0
Open source. Read it, run your own log, or build another implementation.