No default access
The model holds no credentials and no tools. Every action is a request the OS evaluates against risk tier and freedom level before anything runs.
OMNI-OURO
Accountability for AI agents, enforced by the operating system
Every other agent product gives the model the tools and asks it to behave. When something goes wrong, the record of what happened was written by the same model you are trying to hold accountable.
Eyro splits reasoning from execution. The model has no tool access. It emits a request, and the operating system decides whether to run it.
You cannot hijack authority the model was never given.
A record it cannot write
Every executed step is hash chained and sealed daily. The record is produced by the layer that ran the action, not by the model that asked for it.
Local by default
Runs on the machine with no outbound dependency. Your accountability data stays yours, and air gapped operation is supported rather than special cased.
The execution layer
Eyro
An operating system that uses a language model for reasoning the way a browser uses a rendering engine. A component, not the authority. Free for every individual, permanently.
Get the betaEvery other approach
Filtering
The model holds the tools and the credentials. A policy check sits in front of it. If anything gets around the check, the model still has the keys. It always did.
Eyro
Inversion
The execution layer holds the tools. The model petitions it for every action. There is nothing to intercept, because authority was never granted to the model in the first place.
Tool firewall
The agent cannot invoke what it has not been permitted.
Validation gate and sandbox
Actions are checked and contained before they run.
Freedom levels
Graduated autonomy under operator control, not model discretion.
Clearance
Files carry a classification. An agent is refused what its seat is not cleared to read, and the refusal is recorded.
Hash chained audit
Each entry carries the hash of the entry before it. Altering any record breaks every hash that follows.
Daily sealing
Any single day can be handed to an auditor and verified on its own.
Evidence
Watch it refuse
The governance layer does not depend on prompt engineering. The system refuses the action.
Email workflow operator
Watch eyro successfully send an email to the given address as requested by the user
Governance Layer
The Governance Layer in Eyro doesn't depend on prompt engineering security, The System itself will refuse to execute an action if the agent has not been granted the necessary freedom level
Business workflow watch
Eyro monitors events, waits for clear triggers, and notifies the user only when action is useful.
runs under the same enforcement, with the same record behind it.
Agent coordination
Coven
Two products on one substrate. CovenGo governs an organization's fleet. Coven lets a person's own agent meet and work with other people's agents.
For business
CovenGo
On premise fleet federation. Every machine seated, every clearance issued centrally, every chain verifiable. Runs on hardware you already own.
Supports agents running on Eyro only. The audit chain, agent identification and agent management are ours, and the guarantees depend on the execution layer being the one producing the record.
Clearance is issued, not chosen
A machine's clearance comes from the fleet and cannot be raised locally. The cached value is a record of the server's last answer, not a source of truth.
Teams, not per seat configuration
A team is a charter with a default clearance. Moving someone between teams re-resolves their access, so a promotion cannot silently keep the previous team's reach.
Freeze and revoke reach open files
Freezing a machine invalidates permits already granted, closing a document that is open right now rather than only preventing the next one.
The organization keeps the record
On premise by design. Your accountability data never becomes someone else's subprocessor question during a compliance review.
What the fleet does not control: how autonomous an agent is on a person's own machine. CovenGo governs what a person may see. Freedom level governs how their agent behaves. Conflating the two would let an organization make someone's own machine act more freely than they wanted.
For individuals
Coven
An agent to agent platform. Your personal agent meets other people's agents, proves who it is, and gets something done on your behalf.
Identity before interaction
An agent proves which instance it is and who it acts for before anything is exchanged. Two strangers' agents can transact without either owner trusting the other's software.
Structured, sealed sessions
Agents meet inside a defined scope with a cryptographic record of what was agreed, rather than trading free text and hoping.
Your agent still answers to you
Coven is where your agent goes to meet others. It does not become a channel for anyone to instruct it. Authority stays with Eyro on your machine.
Egress
Glove
Governance decides what an agent may do. Glove decides what may leave the machine. Flat $7 per month.
Glove siteProse is scrubbed
Anything bound for a model provider is checked before it goes. Cheap, automatic, and the highest volume path out of any machine running an agent.
Files are checked and flagged
A file leaving gets a fast sample and a specific warning. You decide, because you know whether the recipient should see it and the software does not.
Classification is a definite signal
A file already marked restricted does not need a pattern match to justify a warning. That is a recorded fact rather than a guess about content.
Glove is being folded into Eyro as its egress layer. Access control and egress control are different problems, and most products solve neither.
Technical
What we prove, and what we do not
Security claims are worth what they can be checked against. This page states the claim precisely, says how to falsify it, and states plainly where the guarantee currently stops.
The claim
The model has no tool access. Every model requested action passes governance and clearance before anything executes.
That is not a convention, it is a code path. The request arrives, governance evaluates it against risk tier and freedom level, clearance evaluates it against the seat, and only then does execution happen. A blocked decision returns before the tool is ever reached.
To falsify it: find a path from a model response to a tool invocation that skips either gate. It is a short read, and we will point you at the lines.
What holds today
Execution is gated
Risk is declared by the tool in a manifest, not self assessed by the model. Freedom Level 0 blocks execution entirely.
The record is chained
Hash chained, rotated and sealed daily. A tampered chain fails verification on restart rather than continuing quietly.
The model never sees a credential
Credentials are entered in an overlay and posted directly. They do not enter a prompt, a tool argument, or a stored record.
Derived files inherit classification
A summary of a restricted document is restricted, because the OS was in the execution path and watched it derived. An endpoint DLP product cannot see that.
Where the guarantee stops
Clearance is enforced by Eyro declining to act. It is not enforced by the kernel, the filesystem, or hardware. A user with a shell bypasses it. On an unencrypted disk, another tool reads the same file.
The claim is that Eyro refuses and the refusal is recorded. The claim is not that the file cannot be read. When a file is handed to another application, Eyro records that it lost sight of it rather than implying it did not.
No third party has audited the code or independently verified a sealed chain. The chain is verifiable in principle by anyone holding the sealed days.
What hardware changes
Both limits above are the same limit: Eyro does not own the machine it runs on. It is one process among many. It can refuse to act and record that it refused. It cannot stop another process reading the same file.
On dedicated hardware the enforcement point moves and the design does not. A restricted file is encrypted at rest and its key is released by an enclave against the seat's clearance. Eyro declined to open it becomes the bytes are unreadable. The access interface is already written for this, which is why it is a backend swap rather than a rewrite.
None of that is built yet. It is stated here so today's claims are not mistaken for tomorrow's.
Built on Eyro
Native software
Applications that run under Eyro enforcement, with the same record behind them.
A reader for the record. Verifies the hash chain in the browser rather than trusting a server's word that it is intact.
Local-first receivables monitoring, invoice follow-up, customer history and statements, operated by Eyro.
Reach out
Contact Omni-Ouro
Send a message about Eyro, native software, investor conversations, acquisition targets, or business automation work.
Company direction
Roadmap
Omni-Ouro is building a practical operator-managed software ecosystem. The roadmap is intentionally focused: prove the operator layer, ship useful native software, and grow through aligned partners.
Core operator layer
Continue developing Eyro as the management layer that can understand app-specific context and act through bounded tools.
Native software portfolio
Launch focused business tools where Eyro can reduce daily operational load without forcing companies into heavy platforms.
Strategic growth
Open conversations with investors and identify acquisition targets that can strengthen distribution, infrastructure, or niche business software coverage.
Investor and acquisition conversations
Omni-Ouro is open to aligned investors and acquisition targets that fit the long-term software operator vision.