security for ai · work in progress
Guardrails for AI that acts.
AI can now move money, send email and ship code on its own. Xovern sits between that power and the real world: verify who is at the keyboard, supervise what agents do, screen who you deal with and recover tampered code, with a person signing off anything risky.
private by design Everything runs in your browser. Xovern has no server and no accounts, so nothing you type is ever sent to us.
Plug-ins · 4
plugin://screening · v0.1.0 · live
Screening
Check a customer, supplier or company against the official UK and US sanctions lists before they get access to your product or your money. The lists sync from the government sources every day, and the search runs in your browser, so the names you check never leave it.
Sanctions search loading lists…
A name match is not a confirmed match. Compare date of birth, nationality and other identifiers on the official record (linked) before acting. Matching allows for misspellings, word order and transliteration.
Sources
- UK UK Sanctions List (FCDO). The only source for UK designations since 28 January 2026, when the OFSI Consolidated List closed.
- US OFAC SDN List (U.S. Treasury Sanctions List Service).
- NEXT UN Security Council and EU consolidated lists.
What Screening will not do
- NO Criminal-record or credit checks. Those go through an accredited provider (DBS in the UK, a consumer reporting agency under the FCRA in the US), with the person's written consent.
- NO Scraping social media or tracking people.
- NO Significant decisions about people made by software alone. A person reviews every match (UK GDPR Arts. 22A–22D).
plugin://agent-guard · v0.1.0 · partly live
Agent Guard
Sits between your AI agents and the tools they can call. Every action is checked against policy. Anything that moves money, messages people outside the company or touches production waits for a person to approve it, and every decision is written to a tamper-evident ledger.
Prompt-injection firewall live
Paste anything an agent will read (an email, a web page, a document) and scan it before the model sees it. Rule-based, so it catches known patterns, not every attack. Runs in your browser.
Audit ledger · sha-256 chain live
Every check you run on this page is recorded here. Each entry carries the SHA-256 hash of the one before it, so editing history breaks the chain and shows exactly where.
Waiting for a human preview
Demo agents. The SDK that connects your own agents is in development.
Action policy preview
| Agent action | Risk | Rule |
|---|
plugin://code-recovery · v0.1.0 · live
Code Recovery
Find out whether a repository has been tampered with. Xovern reads the recent history from GitHub, checks which commits carry a verified signature, scans each change for leaked keys and edits to build pipelines, and gives you the exact steps to roll back to the last commit you can trust.
Repository integrity
Uses GitHub's public API without signing in (60 requests an hour per network). "Scan the changes" reads the last 8 commits in full.
Secret scanner
Paste code or config. Runs locally and redacts what it finds. The sample keys are fake.
plugin://verified-human · v0.1.0 · partly live
Verified Human
A sign-up plug-in that proves a real person is creating the account before they get access to your AI tools. Passkeys replace passwords, and a liveness check will stop bots and replayed video. The face check is designed to run on the person's own device, so only a yes or no comes back and no face image or template is stored.
Sign-up flow
- Consent
- Passkey
- Liveness
- Done
Result
// run the flow to see the response
live The passkey step is a real WebAuthn prompt from your device. preview The liveness step is an animation until the on-device model is built.
Planned SDK in development
Xovern.verify({ consent: true, level: "passkey+liveness", storeBiometrics: false // cannot be switched on }).then(r => r.verified && grantAccess(r.token))
guardrails
Defensive by design
Security tools can be turned on the people they are meant to protect. These rules are part of the product, and every plug-in has to declare how it meets them before it can be installed.
Changes and recovery run only on repositories you own and connect. No probing third parties.
Computer Misuse Act 1990 · US CFAA, 18 U.S.C. § 1030Liveness runs on the person's own phone or laptop after explicit consent. Xovern stores a passkey public key, never a face.
UK GDPR Art. 9 · Illinois BIPA (740 ILCS 14) · EU AI Act Annex IIIOfficial sanctions lists only. Deeper checks go through accredited providers with the person's written consent.
MLR 2017 · DBS · FCRAAgents can propose moving money, emailing customers or deploying, but a named person approves it with a passkey.
EU AI Act Art. 14 · UK GDPR Arts. 22A–22DEvery decision, human or machine, is hash-chained, so anyone auditing can see if history was changed.
ISO/IEC 27001:2022 A.8.15 LoggingPlug-in manifest · draft spec
{
"id": "verified-human",
"version": "0.1.0",
"permissions": ["auth:enrol", "ledger:write"],
"data": { "biometrics_stored": false, "region": "uk" },
"lawful_basis": "explicit_consent",
"human_oversight": ["payments", "external_messages", "prod_deploys"],
"owned_assets_only": true
}
Why it is future-proof
- CORE One policy engine, one ledger, one identity layer. Plug-ins add tools, never their own rules.
- STANDARDS Passkeys (W3C WebAuthn), Git commit signatures, SHA-256 and official government data feeds, not proprietary formats.
- REGULATION Each plug-in declares its lawful basis, so a change in the law means a manifest update, not a rebuild.
- MODEL-AGNOSTIC Agent Guard checks actions, not a particular model, so it works with whichever AI you use.