How are you securing your agents before they take real-world actions?

Hey everyone. As we move from chatbots to autonomous agents, the biggest blocker is no longer intelligence—it's security. If an agent hallucinates, it shouldn't be able to drain a bank account or send a rogue email.

I kept running into this while building, so I just open-sourced a solution: The Accountability Layer.

It's a zero-trust execution boundary. You don't give the agent API keys. Instead, it sends its intended action to this FastAPI middleware. The policy engine checks it (e.g., max $50 spend), and if allowed, the layer executes it on the agent's behalf and logs it to a cryptographically tamper-proof ledger.

Built it with strict TDD (198 passing tests) and Dockerized it so it can be self-hosted.

Would love to get feedback from other founders building agents. How are you currently handling agent permissions and audit logs?

Repo here: github.com/kennyryan8886-bit/accountability-layer