astrid-runtime/astrid

Astrid is a portable, capability-secure operating system for composable software.

What it solves

Astrid provides a secure, portable runtime for AI agents. It addresses the security risks associated with giving untrusted AI agents access to local files, networks, and credentials by replacing prompt-based trust with an OS-grade security boundary. Instead of trusting a model to follow instructions, Astrid enforces security at the runtime level using a capability-based security model.

How it works

Astrid operates as a "dumb" kernel that manages a sandbox for WebAssembly (WASM) components called "capsules." These capsules contain the actual logic, tools, and LLM providers.

  • The Kernel: Acts as an event router and capability enforcer. It does not contain business logic or LLM handles; it simply routes IPC (Inter-Process Communication) events and enforces access control lists (ACLs).
  • Capsules: These are WASM components that communicate via a bus. Each capsule declares its requirements and provides specific tools or services. They run in a Wasmtime sandbox with no ambient authority (no direct syscalls or file access).
  • Capability Model: Access to resources (files, network hosts) is granted via signed, scoped, and revocable tokens. No token means no access.
  • Uplinks: Frontends like the CLI or HTTP gateway connect to the daemon as protocol clients to send and receive events.

Who it’s for

Developers building AI agents and operators who need to run untrusted agentic code on their machines with strict, verifiable security boundaries and per-principal isolation.

Highlights

  • WASM Sandboxing: Uses Wasmtime to ensure capsules have no direct access to host memory or syscalls.
  • Cryptographic Capabilities: Resource access is managed through signed ed25519 grants that are principal-bound and expiring.
  • Per-Principal Isolation: Every agent identity has its own isolated capsule access, KV store, secrets, and audit chain.
  • Live Lifecycle: Capsules can be installed, upgraded, or removed from a running daemon without requiring a restart.
  • Signed Audit Chain: Maintains a hash-linked, signed JSONL log of all decisions and calls for independent verification.