Benya
Benya is a personal agent control harness that places governance outside the AI model in deterministic code, ensuring every tool call is checked against user-defined policy before execution. The system keeps credentials out of the model's context, maintains a tamper-evident audit log, and offers a real kill switch that revokes all grants atomically. It is open source under AGPL v3 and supports integrations with Gmail, Slack, GitHub, and other services.
- AI Agents
- Artificial Intelligence
- Cybersecurity
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
AI agents now send, spend, and delete on behalf of users, yet the governance shipped alongside them is mostly a confirmation dialog rendered by the same software that runs the model. The model decides whether to raise the prompt and writes what it says, so a manipulated model can skip the check or misdescribe the action. Users have no deterministic, verifiable way to ensure their agents stay within bounds.
Solution
Benya is a personal agent control harness that places the decision layer outside the model, in deterministic code the model cannot argue with. Every tool call passes through a governance pipeline that classifies the action, checks it against user-defined policy, and writes to an audit log before execution. The model never sees credentials; OAuth tokens are resolved only at the instant a tool runs and then discarded. Grants are one-time or timed, spending caps are hard ceilings, and a single kill command revokes all grants atomically. The entire trust-critical codebase is open source under AGPL v3, with an MIT-licensed audit-chain verifier so users can independently check the record on their own machine.
Target Audience
Primary users are individuals, families, and small teams who want AI agents working on their behalf without handing over account credentials; the earliest adopters are technical users who already feel the pain of inadequate agent governance.
Features
- Deterministic governance pipeline: every tool call is classified, checked against policy, and audited before execution, with no second route to a provider
- Credential isolation: OAuth tokens are encrypted, resolved only at execution time, and never enter the model's context
- Tamper-evident audit log: append-only SHA-256 hash chain with entries written before execution; `benya log verify` recomputes the chain locally
- Granular permissions as (agent, service, verb, noun) tuples with one-time or timed grants (5 minutes to 30 days); no standing "always allow"
- Hard spending caps in dollars per session and per month; calls crossing a cap are held for explicit user approval
- Real kill switch: `benya kill` deletes every grant and clears held calls in one atomic step without requiring re-authentication
- Habenula-authored integrations for Gmail, Google Calendar, Slack, Outlook Mail, and GitHub, plus a sandbox inbox for testing
- Model-agnostic design supporting Anthropic, OpenAI-compatible APIs, or local open-weight models