You, the author
You set direction.
You write the constitution: the values, limits, and approvals that govern the work. Direction and taste stay with you; the system carries them forward.
01 / The Cast
Five parts make governance legible.
Creed Space is easiest to understand as a control room for your values. You choose the direction; the system creates the structure that can carry it, and prove it did.
The Constitution
Values, made machine-readable.
Your principles as a signed, versioned document an AI can be held to — and carried across models through VCP, instead of re-explained to each one.
The Gateway
Checked before it acts.
The Policy Decision Point. Every consequential action is weighed against the constitution before it runs — allow, guardrail, or block, not a flat on/off.
Guardian
Runs on your hardware.
The local runtime that evaluates outputs against your creeds and can read optional runtime signals. Your provider, your machine, your rules.
The Receipt
Proof you can verify.
A signed record of what was authorized and on what basis — auditable offline against published keys, by you, an auditor, or a regulator.
02 / The Loop
Intent goes in. Proof comes out.
Creed Space keeps the loop visible: intent, a check against your values, a decision, a signed receipt, and a record that informs the next turn. That is the difference between automation you can trust and automation you have to babysit.
- Intent A request, task, or tool call enters.
- Constitution check The Gateway weighs it against your values.
- Decision Allow, guardrail, or block — with a reason.
- Receipt A signed, verifiable record is issued.
- Audit & memory The record persists, and informs next time.
The record feeds the next request — so the work remembers what it already decided.
- Allow proceeds within bounds
- Guardrail shaped, or held for review
- Block refused, with a reason
03 / The Pieces
One loop, not a pile of features.
Each piece is a stage in the same loop. You can adopt them one at a time — a constitution and Guardian are enough to start.
- 01 The Constitution You declare the values.
- 02 The Gateway Every action checked before it runs.
- 03 Guardian Allow, guardrail, or block — not on/off.
- 04 Runtime signals Optional local telemetry.
- 05 The Receipt Signed proof of each decision.
- 06 VCP Values that travel across platforms.
- 07 Fleet Govern many agents with audit trails.
- 08 The Audit Trail A history you can verify.
01 / Loop stage
Start with a constitution, not a prompt.
A constitution is a plain-language declaration of what the AI must, may, and must never do. Creed Space compiles it into a signed, versioned creed the rest of the loop can enforce and cite.
Input Your values, limits, and approvals Proof A signed, versioned creed
A school district writes age-appropriateness and pedagogical standards as a creed. Teachers own the wording; Guardian applies it as a review layer before tutoring responses reach students.
How to use it
- Write the outcome you want and the lines you will not cross, in your own words.
- Version the creed so a change is a deliberate, visible event — not a silent drift.
- Keep one constitution per real domain rather than one sprawling rulebook.
Why it's different
- Values become an artifact you can sign and audit, not a tone in a prompt.
- The same creed governs every model you run, instead of being re-explained to each.
- A regulator can read the exact policy that applied to a decision.
02 / Loop stage
Every action is checked before it runs.
The Gateway is the Policy Decision Point. When an agent is about to do something consequential — write a file, send a message, spend a budget — the Gateway weighs the action against your constitution first.
Input A proposed action or tool call Proof An allow / guardrail / block decision, with a reason
An agent proposes a filesystem write. The Gateway checks it against the security-ops creed, allows it within bounds, and records why. A risky escalation, by the same creed, would be held for human review.
How to use it
- Put the checks before the irreversible step, not after the damage.
- Reserve "block" for hard limits; use "guardrail" to shape the safe majority.
- Route the decisions that genuinely need a human to a human.
Why it's different
- Governance happens at the moment of action, not as an after-the-fact filter.
- Three outcomes — allow, guardrail, block — instead of a brittle binary.
- The reason for every decision is captured, not just the verdict.
03 / Loop stage
Guardian runs where your work runs.
Guardian is the local engine. It evaluates outputs against your creeds on your hardware, with the provider you choose, and can read optional runtime signals as supporting telemetry — never a diagnosis.
Input An AI output and the active creeds Proof An inspectable, reproducible verdict
A prompt asks how to bypass a school content filter. Guardian checks it against the educational-safety creed and blocks it on the age-appropriate-content principle, showing the score and the principle that fired.
How to use it
- Run it locally for sensitive work; nothing has to leave your machine.
- Read the per-principle scores when a verdict surprises you.
- Treat runtime signals as context for the decision, not a claim about inner experience.
Why it's different
- Your hardware, your provider, your data — no lock-in, fully open source.
- Every verdict is inspectable and reproducible, not a black-box score.
- Affect-adjacent signals sit alongside policy checks, with the limits stated plainly.
04 / Loop stage
Each decision leaves a receipt you can verify.
When the Gateway authorizes an action, it signs a receipt. Not a log line you take on our word: a signed record you, an auditor, or a regulator can verify offline against our published keys — binding the constitution and policy version that applied.
Input An authorized action Proof An RS256-signed receipt, verifiable offline
Months later, a review asks what governed a release. The receipt names the action, the creed and policy versions, the verdict, and the signature — checkable without an account, against the published JWKS.
- Action
- filesystem.write
- Arguments
- sha256:9c1e…
- Constitution
- security-ops · sha256:b42f…
- Policy version
- sha256:01aa…
- Verdict
- Allowed within bounds
- Signature
- RS256 · verifiable offline
Verifiable offline against the published JWKS — no account required.
How to use it
- Hand a receipt to an auditor instead of re-narrating what happened.
- Verify offline against the published keys; no account, no callback required.
- Bind decisions to the exact creed and policy version, so "why" survives time.
Why it's different
- Proof, not trust: the record is signed and independently checkable.
- It records not just that the AI acted, but the values it acted under.
- The producer-signed limit is stated openly, not papered over.
05 / Loop stage
Values travel across platforms.
The Value Context Protocol (VCP) carries a constitution between AI platforms as signed, verifiable context. Write your values once; they ride along instead of being rebuilt, and watered down, on every new surface.
Input A creed you already wrote Proof Portable, signed context any platform can read
A community encodes its values as a creed once. A provider that supports VCP lets those users bring it into the platform — accountable AI without the provider owning every community’s values.
How to use it
- Author the creed once and reuse it wherever VCP is supported.
- Sign it, so the receiving platform can verify what it is carrying.
- Keep the community that owns the values in control of them.
Why it's different
- Values are portable infrastructure, not per-vendor lock-in.
- One integration lets a provider honour many communities’ constitutions.
- The context is signed and verifiable, not a free-text system note.
06 / Loop stage
Many agents, one accountable history.
Fleet governs agents that act in the world. It places policy enforcement and human review before the decisions that matter, and keeps a cryptographic audit trail across the whole company of agents.
Input Agents carrying real responsibilities Proof Cryptographic audit trails and human review
A development team puts Fleet review before risky tool calls, escalation decisions, and policy changes. Routine work flows; the decisions that carry weight pause for a person.
How to use it
- Decide which classes of decision must never be fully autonomous.
- Let routine actions flow and reserve human attention for the consequential ones.
- Use the audit trail to locate a blocker: an owner, a place, a next action.
Why it's different
- Review sits before the risky action, not in a post-mortem.
- The audit trail is cryptographic, so the history is verifiable, not asserted.
- Autonomy stays useful because the limits are explicit.
Begin
Set one real constitution. Watch the AI answer to it.
Creed Space is most useful when the work has a shape: a value you care about, a creed that states it, and a receipt that proves it held. Start with one.