Architecture
Proposal topology, member authority, sensitivity checks, and safe execution boundaries.
System overview
Members Only is a local Python boundary in which an AI agent can propose work, but the member remains the authority for sensitive actions. The system checks the proposal before execution, requires approval where needed, and records a safe result without copying the private payload into the trace.
Structured action, arguments, destination, and member context
Credential, personal, private-message, and destination findings
Allow, requires approval, or deny
Decision bound to the exact proposal digest
Short-lived, one-use permission for the approved proposal
Synthetic local actions plus an optional approved, read-only Obscura browser fetch
Safe evidence of the decision and execution outcome
Runtime topology
| Runtime | Responsibilities | Primary implementation |
|---|---|---|
| Agent caller | Suggest an action with typed context. It does not receive authority from its own output. | Proposal |
| Security layer | Inspect findings, apply policy, bind approval, and issue a capability. | pipeline.py |
| Action adapters | Run a supported local action or approved read-only browser fetch after the final gate. | adapters/ |
| Persistence | Keep approvals, capabilities, redemption state, and receipts in local SQLite. | storage.py |
| Trace recorder | Write safe state transitions without raw payload-like fields. | receipts.py |
The default demo is local and synthetic. The optional Obscura adapter can make an approved read-only network fetch when its executable is configured.
Authoritative proposal flow
Intent An agent submits a typed proposal naming the action, arguments, and destination.
Inspection The sensitivity layer returns finding types and locations without echoing secret values.
Decision Policy maps the findings and destination to allow, requires approval, or deny.
Approval The member approves the exact proposal. The approval stores a stable SHA-256 proposal digest.
Authorization A capability is issued and consumed immediately before the local adapter runs.
Receipt The result is recorded as a safe trace and receipt. A replay is denied.
Authority and privacy model
| Concern | Control | Failure behavior |
|---|---|---|
| Credential exposure | Detect credential fields and secret-like values before policy. | Deny before execution |
| Personal or private data | Classify sensitive fields and private message bodies without logging their contents. | Require member approval |
| External destination | Include destination risk in the policy decision and adapter boundary. | Require approval or reject in local MVP |
| Changed proposal | Bind approval to a stable proposal digest. | Approval no longer matches |
| Capability replay | Use expiry plus persistent one-use redemption state. | Block the second attempt |
| Trace leakage | Reject payload-like trace detail keys and record safe metadata only. | Refuse unsafe trace data |
Traces and receipts
The demo emits a trace for each important state change and creates a receipt for the final outcome. The record is designed to answer, “What happened?” without becoming a second copy of the sensitive content.
{
"event": "sensitivity_checked",
"proposal_id": "prop_demo_001",
"finding_types": ["private_message"],
"raw_payload": "omitted"
}
{
"event": "execution_blocked",
"proposal_id": "prop_demo_001",
"reason": "capability_already_redeemed"
}State transition, actor-safe identifiers, finding types, and decision reason.
Action identity, execution result, and a bounded failure reason.
Raw credentials, private message bodies, and payload-like detail.
Persistence
SQLite gives the local MVP durable security state across process restarts. The store keeps the decision record separate from the sensitive proposal content used to make it.
| Data class | Storage | Continuity |
|---|---|---|
| Approvals | SQLite | Proposal digest remains auditable |
| Capabilities | SQLite plus expiry checks | Redemption state survives restart |
| Receipts | SQLite | Final outcome remains queryable |
| Trace stream | JSONL recorder | Safe event sequence can be reviewed locally |
Build and delivery
Run Start the local CLI demo and inspect the event sequence.
Test Run the Python unit suite across the security boundary.
Review Open this static documentation site from the GitHub Pages artifact.
Extend Add one detector or adapter while preserving the same gate order.
Local demo
The repository includes a synthetic end-to-end run. It shows member approval, capability issuance, local execution, receipt creation, and replay blocking without making network requests.
first_execution=succeededreplay_attempt=deniednetwork_requests=0Tests: PYTHONPATH=src python3 -m unittest discover -s tests -v
Approved browser fetch
ObscuraActionAdapter uses the Obscura CLI for one bounded action: browser_fetch. Because its destination is external, the policy requires member approval before the capability can be issued.
The repository has a live local fetch verification against https://example.com. It is not production deployment or proof of universal website compatibility.
Current boundaries
- Local synthetic actions and one read-only Obscura browser fetch are implemented. Real external messages, payments, account changes, and browser form writes are not.
- Obscura is an optional external browser engine, not part of the Members Only authority model.
- Web MCP is intentionally excluded from this project scope.
- Detectors are signals. They cannot guarantee that every sensitive value is found.
- The member remains responsible for approving high-impact actions.
- This documentation describes implementation evidence, not user adoption or commercial scale.