Same agent.
Secure runtime.
Policy-governed runtime for executing AI agents and tools under explicit policy, identity, and audit controls.
Strict tool contracts
ToolClad manifests fail closed on unknown controls. Explicit argument arrays, full-value validation, network destination checks, bounded output, and exact approvals for high-risk calls.
Stronger boundaries
Tool execution runs through the governed dispatcher. JWT issuer and audience checks, prefixed API keys, single-use WebSocket tickets, and skill signatures that bind the complete manifest.
Optional workflow upgrades
Governed improvements reach HTTP and scheduled agents with pinned instruction versions and signed evidence. Opt-in prompt caching for Anthropic routes still charges raw token usage.
Upgrading from 1.x? 2.0 is a major release. Read the migration guide and verify downloads with the release verification guide.
Policy-governed execution
Governed execution routes evaluate Cedar policy before tool use. ToolClad constrains how commands are formed, SchemaPin verifies supported MCP tool definitions, AgentPin provides domain-anchored identity, and VectorPin can attest embeddings. Workloads can run under Landlock, Docker, gVisor, or supervised Firecracker isolation. Model output is never treated as execution authority.
Symbiont is the Open Agent Trust Stack (OATS) reference implementation — conforming to OATS Extended (C1–C7 + E1–E8). Security comes from structural enforcement: what isn't permitted is structurally inexpressible, not blocked after the fact.
Explore the Trust StackDeveloper-first
Initialize a governed project with symbi init, validate its DSL with symbi dsl --check, test agents with symbi run, and start configured services with symbi up. On supported Linux hosts, symbi doctor verifies native isolation and cleanup readiness.
Enterprise-ready
Protected, hash-chained journals cover the ordinary and managed CLI, HTTP, scheduled ORGA, and default DSL reasoning routes. Durable invocation IDs preserve retry identity, while run inspection and reconciliation let operators resolve interrupted work without replaying an uncertain tool call. Approval gates bind sensitive actions to the reviewed request.
See enterprise capabilitiesOpen source · Rust-native · Apache 2.0 · OATS reference implementation · v2.0.1 on crates.io