Warrant
GitHub Get started

Least-privilege coding agent

Only what is warranted.
Keep the host.

Warrant is a coding agent that never gets ambient access to your machine — only typed actions a trusted controller can allow, ask, or deny. A prompt is not a permission boundary.

Get started View the source

The problem

Most agents get the keys to the host.

File access, shell, and network make agents useful — and make prompt injection, secret theft, and a wrecked working tree ordinary risks. Approving every call is fatigue. Skipping approvals is hope. Warrant moves the boundary to actions the controller can enforce.

How it works

Four steps. One trusted loop.

  1. 01

    Point at a project

    Warrant copies a disposable snapshot. Symlinks, secrets, and excluded paths never enter the workspace the model can see.

  2. 02

    The model proposes actions

    Only a closed, versioned schema: list, read, search, patch, diff, named recipes. Unknown fields are rejected.

  3. 03

    Policy decides

    Allow, ask, or deny — deterministically. Ask requires a grant. Deny wins. The model never sets the rules.

  4. 04

    You keep the original

    A unified diff is the only artifact written outside application state. Applying it is a human action.

Policy

Allow, ask, or deny — without asking the model.

Select an action. The decision is deterministic. Deny wins over ask. Ask wins over allow.

allow

Bounded, workspace-relative. Secrets and gitignored paths stay out of context.

action proposed by model policy.decide()

Security invariants

Defaults you cannot prompt away.

  • No ambient access

    The model cannot touch files, processes, credentials, or networks. It proposes typed actions. A trusted controller decides.

  • Disposable workspace

    Each task copies a copy. Patches publish as generations. You export a reviewable diff. The original tree stays yours.

  • Exact grants

    Ask decisions require an exact action or a bounded recipe grant — uses, expiry, and a configuration digest. Vague session trust is not a thing.

  • Offline verification

    Tests run in a rootless, network-none sandbox with pinned image digest, dropped capabilities, and hard resource limits.

  • Untrusted input

    Model output, repository files, tool results, and dependency output are all untrusted. Policy does not consult an LLM.

  • Audit by default

    Every proposed and executed action leaves a redacted JSONL record. Secrets are stripped before persistence.

Contrast

Typical agent vs Warrant

Surface Typical agent Warrant
Permission boundary Prompts and allowlists Typed actions + deterministic policy
Write target Your working tree Disposable generations only
Shell Model-shaped commands Named recipes, trusted argv
Approvals Fatigue, or skip-all Exact grants with expiry and uses
Network Often open Offline by default
Audit Chat history Allowlisted, redacted events

Who it is for

Built for people who already feel uneasy.

  • Daily driver, not YOLO

    You want an agent on real work without handing it a shell on the host. Control should feel like power, not paperwork.

  • Local and sovereign

    Ollama stays first-class. Remote models can be adapters later. The governance layer does not change with the brain.

  • Security-minded

    You will read the threat model. Adversarial files, path races, and grant replay are tests — not blog claims.

Stack

What ships today

  • Local CLIinspect, run, resume, discard
  • Patch exportUnified diff, human apply
  • Rootless sandboxPinned image, network none
  • Scoped grantsExact action or recipe
  • Durable tasksCrash-safe generations
  • Linux baselinePython 3.11+, uv, Docker

Get started

Clone, sync, dry-run.

Locked baseline: Linux, Python 3.11+, uv, rootless Docker, a locally bound Ollama server. Ollama is an adapter — not the security model. The policy boundary stays the same when the brain changes.

Open repository
repository root 
uv sync --frozen
uv run --frozen ulg dry-run

Questions

Does this replace Cursor or Claude Code?

No. Those optimize for autonomy. Warrant is for when you want bounded autonomy you can explain: what was proposed, what was allowed, and what never left a disposable copy.

Is the original project modified?

Not by the agent. Inspection and editing happen on a snapshot. The only outbound artifact is a patch you choose to apply.

Can I use a cloud model?

The architecture is provider-neutral. Ollama is the current adapter. A remote API is an opt-in brain, not a bypass of policy, grants, or the sandbox.

Why “Warrant”?

A warrant is an explicit grant of authority. The agent gets only typed actions policy can allow, ask, or deny — never ambient access. The model works. The warrant decides.

What is the license?

Mozilla Public License 2.0. The trusted controller is inspectable. That is part of the product, not a footnote.