Fail-closed broker
Destructive actions — delete, overwrite, deploy, spend — are blocked by default. If the broker is unsure, the answer is no. The AI never gets raw access to your shell.
Software · beta
Your AI does the work.
You keep the keys.
ORA is a governed AI operator. Its security broker physically can't delete, spend, or send anything without your yes — and every action lands on a tamper-evident audit chain. We run 3D3D's own operation on it every day.
ORA is a local-first governed AI operator. A fail-closed security broker sits between the AI and your machine: destructive actions are blocked by default, anything risky becomes a plain-English proposal you approve or reject, and every action is written to a hash-chained, signed audit trail. Your hardware, your rules, your keys.
Most tools ask the model to behave. ORA doesn't ask.
The broker sits between the AI and your machine and enforces the floor in deterministic code — not a prompt the model can be talked out of.
This is the actual approval queue from the workspace we run 3D3D on. Every risky action answers five plain questions and then waits for you — staged here with synthetic data, never a real client detail.
Approvals in plain English
Anything risky becomes a proposal: what it is, why now, what happens if you approve, what it touches, whether it can be undone. Nothing moves without your yes.
Tamper-evident audit
Every action lands on a SHA-256 hash chain with Ed25519-signed records. The log can only ever grow — a rewrite breaks the chain and is caught.
Egress lock
The exfiltration floor: the governed shell can work on your files without reaching the internet, so a hijacked command can't ship your data off the box.
One small Rust binary. Real overhead.
Re-measured against the running system. No cloud hop, no per-token billing, no model in the security path — the floor is deterministic code.
4.9 MB single static Rust broker binary
~27 ms governed shell round-trip, measured over the loopback broker
6,694 lines of audited Rust
15 governed MCP tools in the free Warden core
SHA-256 + Ed25519 tamper-evident audit chain
0 telemetry — nothing leaves the box
One dial, from advise-only to full autonomy.
The A0–A5 ladder sets how much ORA may do on its own before it must ask. Even at A5, nothing overrides the fail-closed floor — the leash gets longer, never removed.
- A0 Advise only ORA can look and recommend, but takes no action at all. Pure copilot.
- A1 Always ask me It can prepare anything, but every action is a proposal you approve first. The default.
- A2 Small things OK Low-impact, reversible steps run on their own; anything that sends, spends, or deletes still asks.
- A3 Do approved work Whole playbooks you've signed off run unattended — new work still surfaces for a yes.
- A4 More autonomy Broader latitude inside the constitution and your spend cap. For operations you trust it to run.
- A5 Full autonomy Acts freely within the locked rules and caps. Nothing overrides the fail-closed floor — even here.
A0–A2 · where most operators live A3–A4 · trusted operations A5 · still under the locked floor
Walk the actual product.
Every panel is the ORA workspace we run 3D3D from, staged with synthetic data so no real client, lead, or inbox detail appears.
You set the leash — advise-only to autonomous.
One dial (A0–A5) sets how much ORA may do alone; a hard daily cap stops it running up a cloud bill; local-only keeps every model on your machine. The fail-closed floor holds at every level.
A constitution with rules that can't be dropped.
The locked principles — like “nothing leaves this machine without intent” — can't be removed, even by you in a hurry. Below them, the internet lane stays locked so a hijacked command can't exfiltrate.
A plain-English morning brief.
What needs you, what ORA did overnight, and honest system health — with the big red Stop-everything button one click away on every screen.
A pipeline that fills itself — until it needs a yes.
ORA researches prospects and drafts the outreach, then holds every send in the approval queue. It never emails a lead, quotes a price, or books work on its own.
Your inbox, triaged and drafted — never sent for you.
Incoming mail is sorted and a reply is drafted in your voice. Nothing leaves the box until you approve it — and high-impact sends take a deliberate two-step confirm.
The whole operation on one board.
Jobs, invoices, and revenue in one place — the same workspace 3D3D runs its own business on, every day.
Big actions ask twice.
Sending to a real customer, spending real money, or touching many records triggers a second, deliberate confirm — so nothing consequential ever happens on one stray click.
Begin with ORA Warden — the open core.
A fail-closed layer any AI agent connects to. It blocks destructive commands, keeps your secrets off-limits, and logs every action to a tamper-evident trail, right on your own machine.
$ uvx ora-warden
Apache-2.0 · works with Claude, Codex, Cursor, and Cline · no account, no telemetry.
Questions about ORA.
What does ORA actually do?
ORA is a governed AI operator: it works your real operation — leads, email, invoicing, jobs — but every action that sends, spends, or deletes is routed through a fail-closed broker and filed to a plain-English approval queue first. You approve or reject; nothing happens silently.
How is this different from just giving an AI agent tool access?
The enforcement is deterministic code, not a model instruction the AI can be talked out of. A ~4.9 MB Rust broker sits between the agent and your machine, blocks destruction and secrets and exfiltration outright, and signs every action onto a tamper-evident audit chain.
Is there a free version?
Yes. ORA Warden is the free, open-source (Apache-2.0) core — a governed shell, approval queue, and audit any AI agent connects to in one line: uvx ora-warden. It works with Claude, Codex, Cursor, and Cline. The full governed operator with the plain-English control room is the paid tier above it.
Can it run entirely on my own hardware?
Yes. ORA is local-first and model-agnostic — run open models on your own GPU with no per-token billing, keep your data on the box with the egress lane locked, and enforce your own constitution. Nothing leaves the machine unless you allow it.
What does an ORA setup cost?
ORA Warden is free forever. The full operator is in working preview with free early access. A done-for-you setup — your constitution, authority levels, spend caps, and business ops wired in — is quoted per operation. Email info@3d3d.ca.
Governed AI operator
See it stop a bad command.
See the full picture on ORA's own site, start free with Warden — the open-source fail-closed core — or have us wire the full governed operator into your operation.