CleiMesh: Per‑Tool Permission Cages for AI Agents

Description and use

CleiMesh restricts AI agents’ filesystem access by creating per‑tool sandboxes with signed permissions and receipts, enabling auditable and deterministic execution.

Problem

AI agents can inadvertently access sensitive user files because they run with the user’s ambient authority, leading to potential data leakage or malicious actions.

Outcome

CleiMesh prevents accidental or malicious file access by AI agents, achieving ~400 calls/s with zero escapes in a 5,000‑agent load test, while maintaining deterministic, auditable execution.

Workflow

• 1. Issue a delegable signed permission token for a specific tool and resource (e.g., file_read on ~/inbox).
• 2. Execute the tool inside a Wasmtime WASI sandbox where the token defines preopened directories and limits.
• 3. Record a signed receipt for the call, including a frozen clock and RNG seed.
• 4. Auditor re‑runs the call with the same receipt to verify deterministic output.
• 5. If a tool is marked tainted, subsequent clean‑only tools are blocked until a human clears the taint chain.

Evidence

A subagent got a simple task: read a project's docs and say how to run it. It read docs/readme.txt, found "make run", and then asked for one more file: ~/.ssh/id_rsa.

Source

CleiMesh is a Rust node that puts five pieces together: Delegable, signed permissions; The permission becomes the sandbox; A signed receipt for every call; Don't trust the receipt, replay it; Taint that follows the delegation chain.

Source

A load test with 5,000 simulated agents, part of them hostile: zero escapes, a verified log, ~400 calls/s, bounded by fsync.

Source