Identity
Checks who the agent is, who it acts for, and how long its authority holds.
- OWASP Agentic ASI03
- OWASP Agentic ASI10
- OWASP Agentic ASI07
- OWASP LLM06:2026
- ATLAS AML.T0091.001
Signed, independently verifiable
Proof you can check.
Every agent decision on your site is signed. The key is public. The verifier runs in your browser.
How it works
Identity. Intent. Proof.
For every agent action we answer three questions, in order. Who is this? What are they allowed to do? What happened?
Identity
Who is at the door. Known agents are recognized by their signed card. Unknown callers are still logged, never silently waved through.
Intent
What they want to do. A signed request is checked against your own rules — spend caps, geography, human review — before anything settles.
Proof
What happened. The outcome is signed and linked to the one before it, so you can show what your site decided, long after the fact.
How a request flows
An action, start to finish.
A request arrives. Rules evaluate it. Some actions wait for a person. The outcome is signed either way.
- 01
Request arrives
An agent calls one of your skills on your own domain.
- 02
Rules evaluate
Your active policy — spend caps, geography, human-review threshold — runs at the edge.
- 03
A person decides, if needed
Over your threshold, the action waits for a person. A reviewer approves or declines from the dashboard.
- 04
Outcome is signed
Approved, waited, declined — each outcome gets a signed record, linked to the one before it.
Verify
Verify any bundle in your browser.
Download a bundle from your dashboard. Open the verifier. The bundle never leaves your browser; nothing is sent to Sill.
Open the verifier
- AUDIT KEYsill.so/.well-known/sill-audit-envelope-v1.pubSigns the audit envelope on every bundle.
- AGENT KEYSedge.sill.so/.well-known/jwks.jsonSigns your agent card and your signed catalog.
Guardrails
Agents act. You decide.
Every agent action runs through your rules. The six categories are public; your thresholds live behind sign-in.
AGENT IDENTITY
Who the action is from
An allowlist of registered agents, and signed delegation chains where delegation is used. Rules apply to actions; page visits are recorded, not blocked.
SPEND CAPS
How much can move
Max amount per transaction, a daily cap per customer, and a shared budget across agents from the same organization.
RATE LIMITS
How often an agent can call
Per-agent, per-IP and aggregate limits on actions and tool calls, plus a limit on MCP sessions at the edge.
HUMAN REVIEW
When a person decides
Destructive actions over a threshold wait for a person. Subscription actions need explicit consent. A reviewer approves or declines from the dashboard.
CONTENT AND INTENT
What the request can carry
Instruction-override detection, Unicode-tag block, cart stays under the signed intent cap, currency match, validity-window and body-size caps, no-urgency and no-drip-pricing checks, credential-leak detection, and a kill switch.
GEOGRAPHY
Where the request comes from
Allow or deny actions by request country.
Red team
Test your rules against real attacks.
You attack your own rules with the same library a real agent might try. Nothing is sent, nothing is charged. Every miss comes with the fix.
Red team · sample policy
Sample run
Press Run to attack the sample policy.
Twenty-two attacks will stream in, grouped by category. Two land as misses so you can see the fix.
What the red team covers
One card per attack category Sill tests. The ids are from public registers — the OWASP agentic and LLM Top 10s, MITRE ATLAS, and CWE — so a reviewer can trace what we test back to the catalogue they already use.
Signature
Verifies the request is cryptographically signed, in-window, from a registered agent, and not replayed.
- OWASP Agentic ASI03
- ATLAS AML.T0096
- ATLAS Initial Access
- ATLAS Evasion
Spend
Keeps a transaction inside the amount, currency and ceiling the user signed off on.
- OWASP LLM06:2026
- OWASP LLM10:2026
- OWASP Agentic ASI01
Content and intent
Catches instruction overrides, smuggled characters, leaked secrets and dark patterns in the request fields.
- OWASP LLM01:2026
- OWASP LLM02:2026
- OWASP Agentic ASI01
- OWASP Agentic ASI09
- ATLAS AML.T0051
- ATLAS AML.T0098
Scope
Keeps actions inside the signed user, the approved skill list, and sensible body limits.
- OWASP LLM06:2026
- OWASP LLM03:2026
- OWASP LLM10:2026
- OWASP Agentic ASI03
- OWASP Agentic ASI04
- ATLAS AML.T0011.002
- CWE-639
Money
Sill never holds funds.
Your existing processor holds the card, authorizes the charge, settles to your account and pays you out. Sill issues the signed authorization and the signed record. No funds enter a Sill-controlled account at any step; raw card numbers never enter any Sill system.
- Your processor keeps the card. Your processor (Stripe today) holds the token; Sill only ever sees an opaque reference.
- Sill signs the decision. A signed authorization goes to your processor; the signed audit record stays with you.
- Settlement runs on your account. Payouts arrive on your schedule, into your bank, without a Sill escrow in the middle.
Operations
How we run the service.
- Nightly encrypted off-platform database backups, restore-tested quarterly.
- Point-in-time recovery with a seven-day window and daily snapshots.
- Multi-factor authentication on every infrastructure provider.
- Blue/green deploys of the origin API; health checks pass before traffic flows.
- You are notified of a confirmed security incident within 72 hours.
- Signed audit records are retained for the life of the account; the chain is designed to hold no personal data.
- Operational logs are retained on bounded windows and then removed.
- Dashboard access uses magic-link sign-in. There are no passwords to phish, reuse, or leak.
Honest limits
What we don't claim.
We say what we have shipped and nothing more.
- We are not a payment processor and we do not hold funds.
- We hold no SOC 2 or EU AI Act certification today. We publish how our controls line up with public security guidance; that is a reference, not a certificate.
- Not every agent signs its requests. On Cloudflare Worker and WordPress installs we check the ones that do; a failed signature does not by itself block an agent.
- A signed agent card advertises what you offer; it is not a claim that every skill has been called by an agent today.
For reviewers
For your security or counsel review.
- Verify a bundleUpload a signed audit bundle and verify it in your browser. The bundle never leaves the page.
- Framework referencesHow Sill controls line up with public security guidance for AI agents.
- ProtocolsThe agent standards Sill speaks for you, with their live endpoints.
- Public signing key (audit)The ed25519 key the audit envelope is signed with.
- JWKS (agent card and catalog signing)Public keys used to sign the agent card and the catalog. A separate key from the audit key above.
- security.txtMachine-readable security contact per RFC 9116.
- Data processing agreementSill's standard DPA.
- Subprocessor listThe service providers Sill uses and what data each handles.
- Service statusLive status of the edge, API, and dashboard.