Open source · v0.4.0 beta · B2A Security Gate

The B2A security gate for autonomous agent actions.

Tempus DDB sits between an AI agent and external effects. Agents sign requests, policy issues short-lived single-use permits, and mediated executors record tamper-evident receipts.

Quick Install pip install tempus-ddb
Documentation 🚀 Live Trace Demo GitHub Repo
CI Status PyPI Release MIT License
Interactive Trace
demo-7f2c…a19e
01
Request signedThe exact action is recorded
BOUND
02
Policy checkedThe decision is recorded
ALLOWED
03
Permit usedOnce, before the effect
USED
04
Receipt checkedThe outcome links back to the request
VALID
Launch in-browser trace verifier →

Protocol

Authorize, execute, verify.

The requesting agent signs an intent. Policy returns an allowed or blocked decision. A separate executor verifies and consumes an allowed permit before acting.

01 / IDENTITY

Sign the request

The requesting workload signs the exact payload it wants executed.

02 / POLICY

Issue a permit

Policy evidence, identity and scope determine an allowed or blocked decision.

03 / EXECUTION

Consume once

The executor verifies the permit's binding, tenant and expiry before any effect.

04 / EVIDENCE

Verify the trace

Intent, authorization and outcome remain cryptographically linked for inspection.

Architecture

Why not a traditional RBAC gateway?

MCP proxies authorize and forward requests, trusting the backend. Tempus enforces a cryptographic single-use toll with dual-signed execution receipts and complete credential isolation.

Zero-Trust Toll

Cryptographic Permits

Unlike RBAC proxies that simply forward calls, Tempus issues expiring, single-use signed permits bound to the exact intent hash.

  • Deterministic intent binding
  • Atomic single consumption
  • Replay attempts fail closed
Credential Isolation

Isolated Executors

The requesting AI agent never touches or sees downstream tokens. Dedicated executors hold secrets in their own isolated process.

  • GitHub Issues & PRs
  • HTTPS POST/PUT Webhooks
  • Slack Messages & Payouts
Verifiable Evidence

Dual-Signed Receipts

Both Gate and Executor sign the outcome. Anyone can verify the entire trace mathematically offline without trusting application logs.

  • Ed25519 signatures
  • SHA-256 state chain
  • Universal money contract

Implementation

Four packaged executors.

Tempus provides out-of-the-box mediated adapters that keep downstream credentials strictly outside the agent's environment.

GitHub Adapter

tempus-github-executor

Audited GitHub issue and pull request creation with isolated GITHUB_TOKEN.

  • Create issues & PRs
  • Allowlisted arguments
  • Replay protection
HTTP & Slack Adapters

Webhooks & Notifications

Generic HTTPS POST/PUT webhook dispatcher and Slack alert executor with isolated secrets.

  • tempus-http-executor
  • tempus-slack-executor
  • Secret header injection
Financial Adapter

tempus-payment-executor

Enforces the universal money contract for payouts, disbursements and charges.

  • Strict minor-unit limits
  • Currency allowlists
  • Isolated payment API keys

Current limits

v0.4.0 is local-first and single-instance.

It does not include distributed permit consumption, independent external checkpoints or a live audit console.

Threat modelReview the executor credential boundary before high-impact use.