Show HN: AgentTrust – Zero-trust security and human approvals for AI agents

AgentTrust is an open-source security control plane intended to sit between autonomous AI agents and the tools or services they can use. Its central argument is that agents with access to shells, databases, cloud accounts, or spending authority need a deterministic boundary: prompt injection, mistaken reasoning, or runaway actions can otherwise expose secrets, damage systems, or incur costs. The project says it supports agent frameworks including LangChain, LangGraph, CrewAI, AutoGen, and OpenAI, and applies deny-by-default authorization with fine-grained, action-specific capabilities. It also describes cascading permission limits for subagents, scanning for prompt hijacking and sensitive data, network defenses against private-address and cloud-metadata access, and budgets, rate limits, and blast-radius scoring.

Sensitive or high-risk actions can be routed to human approval through signed links and single-use nonces; authorized actions run in an isolated sandbox with a watchdog. AgentTrust’s audit design chains events with SHA-256, creates Merkle inclusion receipts, and describes hardware-sealed keys and post-quantum signatures using NIST FIPS 204. A terminal example shows a request to AWS’s metadata endpoint blocked with a 403 and an attached audit proof. The repository also includes a web security-operations dashboard, a threat simulator, server and client code, integrations, tests, and SDKs for JavaScript, Go, Python, and Rust. The presentation emphasizes security guarantees and compliance, making the implementation and verification of those claims important considerations for teams evaluating it.