The Membrane

Fail-closed authorization for AI agents with production write access.

Every model and tool call needs a live, signed, time-bounded scope; each action writes a tamper-evident receipt; broken continuity blocks or severs the agent.

Request a self-hosted pilot Open demo dashboard Quickstart Run the local demo Preview operator audit (synthetic)

Quickstart

From clone to a refused call in about five minutes.

Run a real gate on your machine, send it a signed call that is allowed, then replay the same call and send one with no caller proof. Both are refused. Requires Rust (stable), a C toolchain, git, jq and curl. No Docker and no paid API. The first build takes one to two minutes. 

# 1. build
git clone https://github.com/membrane-hq/the-membrane.git && cd the-membrane
cargo build --locked -p membrane-cli --bin membrane --example operator-request
export PATH="$PWD/target/debug:$PATH" PILOT_DIR="$(mktemp -d)"

# 2. create operator and caller keys, plus an exact grant for the caller
cargo run --locked -q -p membrane-cli --example operator-request -- setup "$PILOT_DIR"
export GATE_PUBKEY="$(jq -r .operator_pubkey $PILOT_DIR/keys.json)"
export CALLER_PUBKEY="$(jq -r .caller_pubkey $PILOT_DIR/keys.json)"

# 3. issue a 15-minute signed scope and start the gate (mock model, local only)
export NOSTR_NSEC="$(jq -r .operator_nsec $PILOT_DIR/keys.json)"
membrane iac issue --caller-pubkey "$CALLER_PUBKEY" --scope-id pilot-scope \
  --model sha256:demo-model --ttl-secs 900 --out "$PILOT_DIR/iac.json"
MEMBRANE_DEV_MOCK_MODEL=1 membrane gate start --registry "$PILOT_DIR/registry.yaml" \
  --iac "$PILOT_DIR/iac.json" --listen 127.0.0.1:8787 > "$PILOT_DIR/gate.log" 2>&1 &
until curl -fsS http://127.0.0.1:8787/health >/dev/null; do sleep 1; done

# 4. sign as the caller and send
export NOSTR_NSEC="$(jq -r .caller_nsec $PILOT_DIR/keys.json)"
echo '{"model":"sha256:demo-model","messages":[{"role":"user","content":"hi"}],"stream":false}' > "$PILOT_DIR/chat.json"
cargo run --locked -q -p membrane-cli --example operator-request -- sign \
  http://127.0.0.1:8787 "$GATE_PUBKEY" "$PILOT_DIR/iac.json" /v1/chat/completions \
  "$PILOT_DIR/chat.json" "$PILOT_DIR/request"
send() { curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8787/v1/chat/completions \
  --header @"$PILOT_DIR/request/headers.txt" --data-binary @"$PILOT_DIR/request/body.json"; }
send   # 200: signed, in scope, receipt written
send   # 403: same proof replayed, refused

Real output from a fresh run: 200, then 403 with caller authentication failed: replay or replay capacity exceeded. A call carrying the scope but no caller proof is also refused: missing caller proof.

This quickstart runs without a relay. Without one, startup and scope issuing each wait roughly 10 to 20 seconds and log connection errors, then continue. A relay adds receipt publishing, ending sessions and evidence export; see the full operator walkthrough.

Quickstart in the docs Operator walkthrough

The problem

Agents have the keys. Logs can't prove who authorized what.

Teams are handing AI agents write access: agents that merge code, change infrastructure, edit tickets, and touch customer data. When an agent does the wrong thing, what's left is scattered logs and third-party chat histories - editable, incomplete, and unable to prove that an action was authorized by an unexpired policy. Incident reconstruction is slow and unreliable.

Demo

A denied call, its receipt, and the audit trail.

Live test

A settled call, a refused replay, and a budget cutoff.

A recorded terminal run of the gate's spend route against a public Routstr node, funded with 99 sats of Cashu ecash. A call settles, repeating the same operation ID is refused without a second dispatch, and a small-budget agent is blocked once its budget cannot cover the next call. The unused balance is then refunded. Keys and tokens are redacted. Receipts record an overrun when the final cost exceeds the reserved ceiling; the gate records it rather than capping it.

The solution

A gateway that fails closed.

The Membrane sits directly in front of your agents. It requires a live, signed authorization for every model and tool call, records each action in a tamper-evident, hash-linked receipt chain, and blocks or severs the agent the moment the chain breaks. Approved actions are provable; unauthorized ones never hit production.

Under your control

Your systems. Your keys. Your policy.

Self-host the gate in your own environment. Hold your own keys, set the allowed models and tools, and check authorization before agents reach your systems. Keep a tamper-evident receipt chain for the actions that pass through the gate.

Why it's different

Enforce - don't just observe or filter.

01

It enforces, it doesn't just watch.

Observability tools explain what an agent did after the fact. Prompt filters rewrite text. The Membrane is an inline control point that refuses unauthorized actions before they reach production.

02

Authorization is bound to the action, not the prompt.

Every action carries a signed policy naming the exact model, tools, and scope, linked into a tamper-evident receipt chain. A silent model or tool swap breaks the chain and is blocked.

03

Incident reconstruction in minutes.

Because approvals and actions are hash-linked, you can trace any action to its authorizing policy and issuer - and hand auditors a signed evidence pack. No dependence on a provider's mutable logs.

Licensed content

Gate every step. Fail closed on missing provenance.

Agents that fetch, transform, or publish licensed assets pass through the Membrane first. Each operation needs a live, signed, time-bounded scope; if the asset's provenance is missing or unverifiable, no scope is issued and the call is blocked.

The demo, in six steps

Grant scope. Allow. Block. Sever. Reconstruct. Prove.

  1. Grant scope

    An operator issues a 15-minute authorization for a support agent: one model, tools limited to jira.comment and slack.post, bound to one task.

  2. Approved action

    The agent posts a ticket comment. A green, linked receipt shows policy → model → tool, all matching and chained to the prior receipt.

  3. Blocked swap

    The agent reaches for a different model, or for github.merge - outside the authorization. The Membrane blocks it; a red receipt shows exactly why.

  4. Expiry / sever

    The authorization expires, or security hits sever. The next tool call fails closed; an alert lands in the incident channel.

  5. Reconstruct

    Open the timeline, click any action, and see the model, context scope, policy, and issuer behind it - no log spelunking.

  6. Export evidence

    One click produces a signed evidence pack. Verify the hash chain offline in seconds. SIEM-ready JSON Lines or OCSF-inspired export for existing SOC tooling.

Try the isolated public sandbox, or run the same interactive walkthrough locally with one command.

Run it locally

One command. No relay, no secrets, no paid APIs.

The software includes the gate, CLI, receipt components, read-only operator dashboard and recommendation advisor. The local demo demonstrates gate checks and receipt chaining with ephemeral keys, an in-memory bus and simulated tool effects. Receipts also export as JSON Lines or OCSF-inspired JSON for an existing SIEM. 

# clone the repo
git clone https://github.com/membrane-hq/the-membrane.git
cd the-membrane

# launch the local Membrane demo dashboard
cargo run -p membrane-cli --features demo -- demo

Then open http://127.0.0.1:8790/

Open demo dashboard Local demo instructions View on GitHub