Accords OS.
The infrastructure layer under agentic markets.
Accords OS structures supply, rights, availability, rules, permissions, lifecycle workflows, transactions, and proof. Its parts: the six layers, CLP, the AccordsVault runtime, and the receipt every action files.
What the OS provides, layer by layer.
- SUPPLY
- Machine-readable records of what is offered — listings, availability, lifecycle state.
- TRUST
- Claims connected to evidence and provenance, gated where the documents require it.
- ACCESS
- Identity, eligibility, authority, and permissions, checkable at the moment of action.
- DECISION
- Turns mandates, budgets, comparisons, and approvals into enforceable rules.
- TRANSACTION
- One governed workflow from execution through settlement, provisioning, and fulfillment.
- PROOF & AUDITABILITY
- A durable receipt of who acted, under what authority, what rules applied, what approvals were given, and what occurred.
CLP — an open protocol for governed action.
ContractLane binds signatures, authorization checks, and payment events into portable, content-addressed proof bundles. Anyone can verify one without trusting whoever produced it. The spec is frozen at v1.0.0; the repository is Apache 2.0.
Live counts, not marketing counts — recount them in the repository.
CLP on GitHub# Contract Lane v1.0.0 — frozen protocol, three SDKsgo get github.com/accordsai/contractlane/sdk/go/contractlane@v1.0.2pip install contractlane==1.0.0npm install @contractlane/sdk# Run the conformance suite against your implementationBASE_URL=http://localhost:8082 \ ./conformance/runner/run_local_conformance.shAccordsVault — the runtime that holds the keys.
The execution boundary inside Accords OS. Credentials stay in the vault and the mandate is applied at the boundary. The agent works with what it's granted, nothing else.
Permission scoping
Agents hold only the capabilities you grant. Least-privilege by design, not by hope.
Credential isolation
Keys never touch agent memory. AccordsVault injects credentials at runtime, inside the boundary.
Budget enforcement
Hard caps applied at execution. An agent can’t exceed its allocation, whatever it was told.
Cryptographic receipts
Tamper-evident proof of every action, verifiable without trusting the agent. Or us.
Instant revocation
Revoke a grant; the next call dies at the boundary.
Environment scoping
Test agents can’t reach production. Grants are environment-scoped by definition.
MCP server and skill: public, Apache 2.0.
Every action ends in a receipt.
Not a log line someone could edit — a portable artifact a third party can check. The specimen on the right is illustrative; its digest is real.
- FIELDS
- Typed label/value pairs — the action, the mandate, the venue check, the outcome.
- DIGEST
- SHA-256 over one canonical serialization of those fields. Change a character, change the digest.
- SIG
- ed25519 over the digest, against published venue keys. Not live yet — and the artifact says so.
The digest below is the actual SHA-256 of the specimen’s fields, computed when this page was built.
Verify one yourself- ACTION
- Buy 25,000 units · tokenized T-bill fund TBF-01
- MANDATE
- Money-market instruments only · ≤ $50,000/day · expires 2026-09-30
- VENUE
- Order admitted · agent identity ag-7f2e · mandate check passed
- OUTCOME
- Filled 25,000 @ 1.0002 · settled T+0 · receipt filed
Illustrative specimen of an Accords action receipt. The bundle hash is the real SHA-256 of this specimen’s fields — recompute it yourself. Receipts are what the runtime emits; the ed25519 signature lands when venue keys publish. This specimen claims the shape.
Read the protocol that gates the book.
Infrastructure a market runs has to be inspectable. The protocol is a public repository under Apache 2.0, so an audit of CLP doesn't need our permission. The AccordsVault MCP server and skill are public under the same license.
Accords governs what agents do on the open internet.