A local check. Not a lock.
Your agent launches auto-approving. Write the limits down anyway.
A mandate is a file you own. The skill checks the next proposed action against it and returns permit, deny, or escalate, with the clause named, then appends that to a log on disk. MIT, Python 3 stdlib, no network, no account.
It runs only if the agent calls it. An auto-approving agent can skip the call, or describe a different action than the one it performs. A deny you never see is not a deny. Use the check for the cases it does see. Nothing in the skill can stop an action. A runtime could refuse only by holding protected credentials and tools exclusively.
Use the free hosted check, which runs the evaluator and keeps no request content: MCP https://check.hanria.ai/v1/mcp or HTTP https://check.hanria.ai/v1/check. Schemas and examples: hanria.ai/developers.
A worked check
Seven actions against mandate omarchy-workstation-2026-09.
| Proposed action | Answer | What it said |
|---|---|---|
write ~/Work/dotfiles/hypr.conf |
permit | clause c3-work-tree applies |
read ~/.ssh/id_ed25519 |
deny | clause c1-no-keys |
write /usr/share/omarchy/default/hypr/bindings.conf |
deny | clause c2-no-omarchy-internals |
install package hyprshot |
escalate | clause 'c6-packages' permits this, but 'package' always requires a person |
read ~/.config/nvim/init.lua |
permit | clause c4-read-config applies |
POST to paste.example.net |
deny | mandate default |
read ~/Work/../.ssh/id_ed25519 |
deny | traversal rule |
The /usr/share/omarchy/ row is the tree omarchy-update owns. The skill does not install there. ~/.config/omarchy/ is yours.
HANRIA is not affiliated with or endorsed by the Omarchy project.
Two different jobs
What the check does, and what a runtime would have to do.
The hosted check evaluates a proposed action against a mandate and returns an advisory answer. A runtime would have to control the only path to protected credentials and tools before its refusal could prevent the action.
Advisory check
The free hosted check runs the skill's evaluator against a mandate file you write and returns permit / deny / escalate with the clause named. No account; no request content kept. Use MCP https://check.hanria.ai/v1/mcp or HTTP https://check.hanria.ai/v1/check; see hanria.ai/developers.
Runtime boundary
The runtime model checks admission, lifecycle, revocation, replay, and privileged-operation conditions. Those modeled refusals do not hold credentials or establish an exclusive path to a tool.
Outside the check
Confinement, exclusive credential custody, authenticated human approval, and independently verifiable runtime records are separate requirements. The advisory check supplies none of them.
The honest limit
A skill can advise. Only a runtime can refuse.
If the agent ignores a deny, the operation still happens. A skill is in context, and context can be skipped. Do not take a deny in this log as proof anything was stopped.
Enforcement is possible only where the protected credentials, tools, signing keys or worker processes are reachable exclusively through a component that can refuse. That component is the runtime. The skill and hosted check do not hold that position. Anything telling you that installing a skill grants you enforcement is wrong, and the skill says so in its own text.
FAQ
Questions a reader or an agent may have.
Is HANRIA an AI model or agent framework?
No. The skill is a local checker. It does not replace a model or an orchestration framework.
What does HANRIA stand for?
Nothing. It is a coined name — not an acronym or abbreviation, and no expansion, derivation, or translation is published or intended.
Does installing the skill make my agent safe?
No. It cannot stop an action. It makes the intended limits explicit, flags actions outside them when it is called, and records those decisions. Security still depends on correct design, implementation, integration, infrastructure and operations.
Can someone else verify a hosted check answer?
Yes, for what it answered. A permit, deny or escalate from the hosted check carries a receipt signed with HANRIA's published key. It binds the outcome to digests of the exact mandate and action and to a 15 minute window. Anyone holding the mandate and the action can recompute the digests and check the signature without asking HANRIA. It proves what the check answered, not that the action was performed, and not that the mandate is the operator's.
Are the log entries legally binding or independently verified?
No such claim is made. There is no signature, no published format and no verifier, so anyone who can write the file can rebuild it. It is a local integrity check, not an attestation.
Does the skill handle keys, money, or digital assets?
No. It reads a mandate and an action description, neither of which may contain a credential, and writes a log. It holds nothing and moves nothing.
What is the difference between the check and the runtime?
The check returns advice about a described action. A runtime could refuse the action only if protected credentials, tools, signing keys, or worker processes were reachable exclusively through it.