Question

UNISON Guardian

UNISON Guardian is an open, testable sandbox for delegated authority in AI agent systems. It maps registered paths, rechecks queued actions and hierarchical agent ancestry at execution time, enforces bounded spawning, and keeps an inspectable evidence ledger. Model suggestions are advisory only — they cannot grant authority or override the verifier.

Live sandbox: unison-guardian.info-ccehospitalitygroup.workers.dev
Source: github.com/DeontewattsV1/UNISON-StateBench (guardian/ directory)
License (Guardian source): Apache-2.0

Demo video

3-minute screen capture of the public sandbox (GitHub release asset, ~3 min).

Screenshots

The problem it demonstrates

Agent permissions often span a planner, delegated agents, queued work, and a tool gateway. Removing one authorization may leave another path to a protected action. Developers need a way to see that distinction and reproduce the failure.

How it works

1. Pick a scenario (Queued delegation, Alternate authority path, or Incomplete inventory) and Run baseline.
2. One synthetic operation executes while authorized; another may be queued.
3. Revoke authority on the planner's primary grant.
4. Replay queued action — the gateway checks current authority again and either denies the stale operation or reports a surviving alternate route / incomplete coverage.
5. Inspect the evidence ledger and export JSON receipts.

All principals, grants, and protected actions are synthetic. The protected action increments a demonstration counter; it does not move money, revoke real credentials, or control third-party systems.

Key features

• Authority graph — registered synthetic principals, delegated grants, queued worker and tool-gateway routes, including an independent alternate path.
• Action-time verification — enqueue-time permission cannot substitute for current authority at commit.
• Three scenario outcomes — bounded PASS, surviving-path FAIL, and incomplete-coverage UNKNOWN.
• HATS lab — Macro → Meso → Micro → Nano hierarchy with lineage digest recomputation, capability subset checks, depth/scope/spawn quotas, and ancestor revocation.
• Evidence ledger — per-run event receipts, local SHA-256 consistency checks, filters, and downloadable JSON. Labels distinguish SIMULATED, OBSERVED, UNKNOWN, and CONJECTURE.
• Public Cloudflare Worker sandbox — SQLite-backed Durable Object per anonymous browser session; model requests disabled on the public entry point.

Limits (stated clearly)

• Synthetic routes and a local protected-action counter only.
• Ledger hashes support consistency inspection, not authenticated legal identity or an immutable external archive.
• Analytic "spawn pressure" heuristics are uncalibrated and advisory.
• The public Worker does not call paid models; a local Node adapter can target Meta's Responses API with a server-held key, but model output never authorizes actions.
• Existing UNISON-StateBench Python benchmark code outside guardian/ is prior work under MIT and is not part of the Guardian component.

How to get involved

1. Open the public sandbox and run the scenarios.
2. Clone UNISON-StateBench, then from guardian/: npm ci && npm run dev (Node.js 24+).
3. Run npm test, npm run build, and npm run test:worker before proposing changes.
4. Open issues or pull requests against the public repository. Keep credentials, private research packages, and anything marked confidential out of contributions.

Builder: Deonte Watts (GitHub).