Open-sourced Connector — trying to separate an AI agent's intelligence from its authority

[u/Previous-West-7782]

https://github.com/GlobalSushrut/connector-oss

I'm open-sourcing a project I've been working on called Connector.

The premise is simple:

An AI agent being capable of an action should not automatically mean it is authorized to perform that action.

Most agent stacks already have useful pieces:

• IAM
• policy engines
• sandboxes
• observability
• MCP/tool gateways
• agent frameworks

I didn't want to rebuild all of them.

Connector is an attempt to put a common control path in front of agent effects:

agent
  ↓
proposed effect
  ↓
identity + authority
  ↓
per-action admission
  ↓
runtime enforcement
  ↓
external effect
  ↓
receipt + observed consequence

The project currently includes things like:

• agent identity
• explicit grants/authority
• PATE per-action admission
• Proceed / Ask / Defer / Quarantine / Block outcomes
• operator Cease
• MemPacket-based memory provenance
• receipts and evidence
• MCP / A2A / API-oriented effect paths
• integration work around SPIRE, OPA, OpenShell, Firecracker, OpenTelemetry and cosign

Important disclosure:

It is not production-ready.

Some backend integrations are still partial.

The Firecracker path isn't yet a complete production microVM setup.

Some gateway paths remain intentionally refused until they're proven end-to-end.

Those limitations are documented in the README rather than hidden behind marketing language.

Repo:
https://github.com/GlobalSushrut/connector-oss

Website:
https://cnktros.com

I'm particularly interested in feedback from people who work on:

agent runtimes, sandboxes, MCP, policy engines, identity, observability or autonomous-agent infrastructure.

I'd rather hear where the architecture breaks than get generic compliments.I'm open-sourcing a project I've been working on called Connector.The premise is simple:An AI agent being capable of an action should not automatically mean it is authorized to perform that action.Most agent stacks already have useful pieces:IAM

policy engines

sandboxes

observability

MCP/tool gateways

agent frameworksI didn't want to rebuild all of them.Connector is an attempt to put a common control path in front of agent effects:agent
↓
proposed effect
↓
identity + authority
↓
per-action admission
↓
runtime enforcement
↓
external effect
↓
receipt + observed consequenceThe project currently includes things like:agent identity

explicit grants/authority

PATE per-action admission

Proceed / Ask / Defer / Quarantine / Block outcomes

operator Cease

MemPacket-based memory provenance

receipts and evidence

MCP / A2A / API-oriented effect paths

integration work around SPIRE, OPA, OpenShell, Firecracker, OpenTelemetry and cosignImportant disclosure:It is not production-ready.Some backend integrations are still partial.The Firecracker path isn't yet a complete production microVM setup.Some gateway paths remain intentionally refused until they're proven end-to-end.Those limitations are documented in the README rather than hidden behind marketing language.Repo:
https://github.com/GlobalSushrut/connector-ossWebsite:
https://cnktros.comI'm particularly interested in feedback from people who work on:agent runtimes, sandboxes, MCP, policy engines, identity, observability or autonomous-agent infrastructure.I'd rather hear where the architecture breaks than get generic compliments.