Agents that hold exactly what you grant.

A project sets ceilings, not grants.

The folders a project may use and the add-ons it enables bound what an agent may ever ask for. They grant nothing on their own.

Every prompt is bound to its project, session, generation, prompt ID, idempotency key and exact text. For each one, Kore creates generation-bound agent routes and capability grants, and revokes them before the next prompt is admitted, so nothing an agent held carries over.

A workspace folder is opened as a capability and imported into Kore. Changes come back to the host only as exact change sets, within explicit byte and file limits.

Every agent holds less than its parent.

A broker at the root holds the session's capabilities. Each worker it spawns, and each sub-agent below that, derives a subset of what its parent holds: Kore's attenuation rule, drawn on screen.

The agent view shows the authority tree as it stands: spawn lineage between agents, the capabilities each one holds lit, and the ones withheld from it still on its card, dimmed. The filesystem view shows the same session from the other side: the workspace's containment, and the dashed permission edges along which an agent can reach a file.

Approvals a model can't forge.

Model output, tool results, files, web pages and transcript text can't approve anything. An approval is an authenticated local action over its exact action, session, ID, issue time and expiry, and it can be used once.

A request shows the current and requested scope side by side: files, tools, accounts, recipients, network destinations, budgets, delegation and duration. A partial approval must be a subset of the request, and produces a new, narrower grant rather than blessing the original.

vKore records decisions; it doesn't mint capabilities. The resident Kore broker independently checks its live holdings, the target generation, uses, expiry and the whole transaction before installing anything. Policy lives in a keyed, append-only audit chain: a gap, an edit, a reordering or the wrong key fails closed. Revocation takes effect at once.

The model never holds a capability.

Inference runs locally on llama.cpp, which receives model inputs and bounded sequence state, and never guest capabilities, host descriptors or the ability to run a tool.

Only validated public assistant text reaches the chat. Model fragments, validation envelopes and raw protocol records stay in the append-only transcript, where they can be audited. vKore never downloads or guesses a model: you supply both the server and the weights.

Installing an add-on grants nothing.

Add-ons are tools that run on the host, inside the Kore guest, or split across both. Installing one doesn't let any agent call it.

Every call is checked against the exact package, generation, prompt, arguments, resource scope, mediation, expiry, call budget, replay state and revocation state. Packages are signed and content-addressed, with compatibility checks, offline bundles and rollback. The reference add-ons include Git, scoped to one exact repository, and Gmail, through vKore's credential-brokered HTTPS boundary.