nanoinfra
Documentation ↗ GitHub ↗ Install
3 scenes

Simulated session

One deployment, three answers
to the same command

Allowed while you are watching. Refused at 02:35 when nobody is. And commissioning names the grant it needs before that hour arrives, not at it.

allow · it runsapprove · a person answersdeny · no host is reached

nothing on this page reaches a host

▸ nanoinfra — staging 127.0.0.1:8765 / chat / websocket:3f8c21b4 simulated · recorded from a run
operator ▸  
agent ▸ execute_on_server web-01 "uptime"
gate ▸ allow · interactive · mutate.remote · asked nobody
host ▸ 20:35:04 up 19 days, 4:11, load average: 0.14 0.09 0.08
audit ▸ gate-2026-08-23.jsonl · allow · sha256:d321cac8…
cron ▸ package-check-daily · fires 02:35 UTC · nobody is awake
agent ▸ execute_on_server web-01 "apt-get update -qq && apt list --upgradable"
gate ▸ REFUSED · unattended · mutate.remote at host scope · no standing grant
delivery ▸ the refusal reaches you, and the host is untouched

The grant that would permit it

contexts: ["unattended"]
hosts: ["web-01"]
commands: ["apt-get update -qq && apt list --upgradable"]
rehearsal ▸ creating the automation runs it once, every gated tool forced to preview
preview ▸ execute_on_server · nothing executed · 0 bytes left the process
verdict ▸ permitted — standing grant package-check covers this action, so nobody was asked
saved ▸ enabled, next run 02:35 UTC · commissioning ok · fingerprint 379386df

Commands run on a host

1 of 3

Decisions written to the log

4

People asked

0
allowyou asked · 1.4 s rehearsalat creation · nothing ran refused02:35 · nobody awake

one session, plotted where each answer happened

This is a real session, recorded from a real run and replayed here. Nothing on this page reaches a host, and no number was written by hand — the script is generated from the transcript.

How a session is recorded → Run it yourself: uv tool install nanoinfra

Why the middle scene
is the product

An agent that can reach your hosts is only as safe as what it does when nobody is looking. The shipped policy answers that question with a refusal, and the refusal names the exact grant that would change the answer.

You write that grant into config, where it is reviewed like any other change, and it names contexts, resolved hosts and exact command strings. Reachability is not authority.

Every capability →