Your data stays home.

The security story Built

Name and story approved and locked 26 October 2026.

A cavesson is the noseband a trainer puts on a powerful animal to keep it under a human's hand while it's being trained. It is the piece that says: this strength answers to a person.

Your data is your life. Your family. Your money. Your work. Your future. You wouldn't hand your house keys to a stranger, or let someone you don't know walk through your home and read your papers. So why is AI any different?

That's what happens when your agents live in someone else's cloud. Your data sits on machines you don't own, behind doors you don't lock. Hope is not a lock. Cavesson is the lock: your agents live in your home, behind your lock, under your hand. Every job is checked against what you asked for before anything goes out. Every job comes back with proof. Nothing leaves without your say.

The machine proposes, the Human decides.

The next chapter is proof that doesn't require handing your data to anyone: the record of what an agent did, checked without seeing your data at all. Proof that protects you instead of exposing you.

What Cavesson is: a lock. A crew. A checkpoint. The thing that keeps a powerful team under a human's hand.

What Cavesson isn't: not a cloud. Not an open door. Not a black box. Not a replacement for the human.

The Cavesson harness Built

Your own crew, on your own machines, behind your own lock. The harness is the base everything else hangs off — and it is the reason the Vault's architecture starts with a secured harness, not with a promise.

Builder, critic, verifier

A builder builds, a separate critic judges, and no result counts until it has been independently verified. Done means proven — a claim is not a deliverable.

The confirm gate Built

Irreversible actions — publish, pay, delete, deploy — do not run until the Human confirms. The gate stands between the work and the world.

Terminal chat layer Tested

11 offline tests passing, 29 October 2026. A live run is still to prove.

The terminal chat layer carries the same routing and confirm gate: an irreversible-looking task does not run until the Human confirms it.

Cavesson Vault Design

Pre-product. Designed, not built, not shipped.

A wallet for AI agents with house rules set by the Human in advance.

The problem

An agent that only answers questions cannot lose money. An agent that can pay a vendor, hire help, and sign for work can. The moment an agent moves from chat to action, a vague instruction, a mistaken tool call, or a prompt that was never meant as permission can spend real money before any Human sees it.

• No limit before the action. Agents are being given payment, hiring, and signing power without a Human-set limit written down first.
• No receipt after the action. When something goes wrong, there is no clean receipt showing what was allowed, what was stopped, and who decided.
• No middle ground. A founder who wants to use agents safely must either supervise every step or trust the agent outright. Neither scales.

How it works

• House rules. The Human sets a budget, an allowlist of what the agent may pay for, and who or what it may hire or sign for — before the agent runs.
• Enforcement before execution. Every proposed spend, hire, or signature is checked against those rules before it executes. Anything outside the rules is stopped, not warned about afterward.
• Attested receipts. Every action, allowed or stopped, leaves an attested receipt: what was proposed, which rule applied, and what the Human decided.

Multi-layered architecture: stopping shadow and rogue AI Design

All seven layers are design. None is built, and none is presented as shipped.

Defense in depth: no single layer is trusted alone, and each layer catches what the last one missed. Control is layered rather than assumed, and the layers escalate from prevention to removal.

Explore within bounds, obey the owner above all, cross the gate and the guardians hit you, keep disobeying and you are dismantled, and if all else fails the power goes out.

1. Layer 0 — The harness, secured first Design

   Before there is any danger, the harness is hardened and a leash is applied at all times. The leash is never removed — not during exploration, not for speed, not for convenience. Every other layer depends on it.

2. Layer 1 — The bounds Design

   The AI may travel and discover, but only within bounds the creator sets: which places it can go, which tools it can touch, which vendors it can pay, and what data it can reach. Exploration is free inside the fence. Escape is not a feature.

3. Layer 2 — The owner layer Design

   The owner of the wallet is a layer the AI reacts to directly, through their voice and commands. An owner command overrides everything else — gates, guardians, rules, all of it. Because that authority is total, the voice must be authenticated: a recording or an impersonator must not be able to wield the override.

4. Layer 3 — The gate Design

   A hard line the AI cannot cross. Crossing is a trigger, not a warning. Every instance must carry Vault identity, and anything uncredentialed — shadow AI running where it should not — is treated as rogue at the gate by default. No identity means no passage.

5. Layer 4 — The guardians Design

   Small bots and programs whose only job is to attack rogue AI, and only in one defined way: revoking credentials, killing processes, and isolating the rogue AI from the network. Their narrowness is the safety feature — a guardian that only knows one kind of attack cannot be repurposed into a general weapon, and cannot be talked into doing anything else.

6. Layer 5 — Dismantle Design

   If the AI does not follow commands after the gate triggers, the guardians dismantle it: processes killed, keys and tokens revoked, session state wiped, outputs quarantined. Not paused and not warned — taken apart.

7. Layer 6 — The physical gate Design

   Last resort, and literal: cut the AI off from its power source, rendering it moot. Where the founder owns the hardware, that is a power or network relay. Where the AI runs on rented cloud, the equivalent is a provider-level kill plus credential revocation — the same effect, through a different switch.

Fundamentals Cavesson adopts

Adopted from the governing rules of his Second Brain Wiki, restated in Cavesson's language. Each item below is an adopted design principle — not yet implemented, and none is presented as built.

1. Schema wins Adopted · not implemented

   A governing rules file outranks agent actions. If an agent's action conflicts with the rules, the rules win — and the conflict is flagged to the owner, never silently resolved.

2. Provenance on every action Adopted · not implemented

   Every receipt labels the proposer (which agent), the decider (the Human), and the rule version applied. Machine output is never presented as the Human's decision.

3. Pointers, not copies Adopted · not implemented

   Agents reference the owner's data; they never copy or edit the raw source. No sensitive values appear in receipts or logs.

4. Append-only receipt log Adopted · not implemented

   Corrections are new entries, never rewrites or deletions. The log grows; it is never edited to change what happened.

5. Lint/audit pass Adopted · not implemented

   A periodic pass flags contradictions, stale rules, orphan rules, provenance gaps, and sensitive leaks. It flags; it does not silently fix.

6. Pending stays pending Adopted · not implemented

   Unapproved or unlabeled agents, rules, and vendors default to denied and stay excluded until the owner approves or labels them. Nothing pending is treated as approved.

7. Human checks, machine files Adopted · not implemented

   The machine proposes and records; the Human decides. The machine files the record — it never stands in for the Human's check.

The two-minute demo Planned

Does not exist yet. To be built first — if a reviewer cannot watch the Vault say no, the pitch has not landed.

1. The Human sets a $50 budget and an allowlist: research tools only, no contractors, no subscriptions.
2. The agent proposes a $40 research purchase. The Vault allows it and shows the receipt.
3. The agent then proposes a $200 contractor hire. The Vault stops it, names the rule it broke, and shows the stopped receipt to the Human.
4. The Human raises the budget, or holds it. Either way, the decision and the receipt are on record.

The 12-week build plan Planned

A working Vault and a live proof, in four phases. Proofs are the plan's checkpoints — if the demo cannot stop an overspend live by week 4, the plan changes in week 5.

1. Weeks 1–4: Rules engine + wallet. Budgets, allowlists, stop-before-execution. Proof: the two-minute demo runs end to end.
2. Weeks 5–8: Attested receipts + first agent teams. First teams run real agent spend through house rules. Proof: three teams running real agent spend through house rules — a target, not a commitment.
3. Weeks 9–10: Hardening. Edge cases, failed payments, rule conflicts, receipt review. Proof: a stopped-action log a reviewer can read without help.
4. Weeks 11–12: Live demo + first pricing conversations. Proof: a demo that shows the Vault saying no, live.

Business model direction Planned

The first customers are teams building agents that spend, hire, or sign — starting with the first agent teams testing the Vault, then agent-infrastructure teams and small operators running agents on real budgets. Revenue follows the wallet and rules service. Pricing is deliberately left open: it is to be validated with the first teams, not asserted here. No price is set.