Halofy released an open-source identity and audit layer for AI agents

Halofy is a new open-source access and governance layer for AI agents that reads the credential, resolves the namespace server-side, enforces the ACL, and records every read, write, and denial before the agent touches organizational context. The repository was created on 22 August 2026 and reached 424 stars and 33 forks by 6 September. The kernel and console are AGPL-3.0-or-later, and the driver and MCP directories are Apache-2.0 so an integrator can embed them without relicensing the host application.

What the boundary controls

Identity is set by the server. Namespace, actor, role, and source scope are read from the credential, and the MCP tool schemas leave out the identity fields entirely, so a request body has no place to put them. Access is one policy across agents, applications, operators, MCP, and HTTP, so a caller in namespace org/support/agent-1 sees rows belonging to org, org/support, or its own path, and never a sibling like org/support/agent-2 or its own descendants unless an explicit administration path removes the restriction and records that it did.

The state model is append-only. A correction closes the prior fact's validity interval and links to the replacement, so history stays readable during an audit. Retrieval drivers receive an already-scoped view and can return references only, with no path to writes or to the audit and storage modules. Every outcome appends an event, denial and brownout included. Erasure creates a signed certificate that a third party can verify.

The demo runs offline, with no keys and no network

The maintainers made the whole system run on the local machine before asking for a database or an API key. The included demo starts the real kernel on embedded PGlite, pins a policy, assembles a working set, faults a missing context, imports data, and creates a signed erasure certificate, without an API key, an external service or a network call. The suite reports 2,678 tests across 205 files and 6 of 6 driver-conformance checks passing.

Storage is Postgres or pgvector for a durable deployment, and PGlite embeds the same model for local work. Four public connectors are included in the repository: filesystem, Postgres, Obsidian, and a manual CSV import, all feeding the one governed write path.

Open by design, with paid extras

There is no licence key, no edition flag, no activation, and no telemetry beacon. The public quota port defaults to unmetered. Halofy's managed side, described in the docs as the funding model for the kernel, is model routing and spend attribution, hosted usage plans, operated chat integrations, a managed connector catalogue, federated live query across organizations, and support commitments. None of those are required to run the repository, and the boundary between the open and managed parts is documented file by file.

AGPL on the kernel is the same constraint every self-hostable governance product has now. A team using Halofy as-is inside its own organisation is unaffected. A team that modifies the kernel and exposes the modified version as a service to third parties has to publish those changes under the same licence.

Source

halofyai/halofy on GitHub, and the project's own architecture guide and open-source scope documents. Star, fork and creation dates from the GitHub REST API, verified 7 September 2026.