CROA

Constrain what AI agents can reach

31 followers

Constrain what AI agents can reach

31 followers

CROA is an open, vendor-neutral architecture for governing what AI agents can actually execute. Instead of relying on the agent to respect constraints, CROA separates intelligence from authority and constrains execution against registered invariants before state change. The public Pilot makes the approach reproducible: run it, inspect the evidence, and try to break the claim.

Free

Launch tags:Open Source•Developer Tools•Artificial Intelligence

Launch Team / Built With

Render Sandboxes: a computer for every agentRun untrusted code safely. Idle sandboxes cost nothing

Promoted

Maker

📌

We started working on CROA because we kept coming back to the same problem: as AI agents move from generating answers to taking actions in real systems, asking them to “follow the rules” is not enough. The question that interested us was actually quite simple: what happens when an agent has legitimate access to its tools, but a sequence of individually acceptable actions leads somewhere the organization never intended? That changed the way we looked at the problem. Instead of trying to make the model itself the authority, CROA separates intelligence from execution authority. The agent can propose. It doesn't get to decide what is allowed to change in the real world. We published CROA as an open architecture because we don't think this should be another black-box governance product. And we've deliberately made the central claim conditional and falsifiable. The Pilot we're releasing here is part of that. You can run it locally, reproduce the scenarios, inspect the evidence and see exactly where execution is permitted or stopped. This is still a public review project, not a finished standard, and the Pilot is not independent validation. In fact, earlier testing of our reference work found real weaknesses, which we documented publicly and used to improve the architecture. So we're not really looking for “looks great” feedback. If you work on agents, security, enterprise architecture or AI governance, try to break it. Find a path we haven't considered. Challenge an assumption. Tell us where the model doesn't hold. That's exactly why we're putting CROA out in the open.

Report

2mo ago

Bitrise

Congrats on your live 🎉

Report

2mo ago

Maker

@lisadziuba Thank you !

Report

2mo ago

Forum Threads

p/croa

•

2mo ago

Where should execution authority live in an agentic system?

One of the assumptions behind CROA is that an AI agent should be able to propose actions, but should not be the final authority deciding whether those actions are allowed to change the state of a real system.

That sounds straightforward until you start looking at trajectories rather than individual actions.

Imagine an agent is allowed to expose up to 100 customer records. It performs three operations:

expose 40 records
expose another 40
expose another 40

View all