Where our evidence sits
We start from object capabilities because they already meet two of the four requirements in production. Authority is a reference that can't be forged or guessed. Whoever holds one can narrow it and pass it on. Organizational revocation is missing and accountability is partial, and those are the parts the FRO has to build.
Hardened JavaScript
Ordinary JavaScript lets any piece of code reach shared global state and rewrite the language's own built-in objects. Hardened JavaScript freezes that shared state and runs each program in a compartment that holds only the references it was handed.
It confines authority for millions of MetaMask users today, and Agoric's smart contracts run on it.
Endo
AI coding agents run with their user's full access to the filesystem, the shell, the network and stored credentials. One successful prompt injection inherits all of it. Researchers have reported injection success rates as high as 84% against unprotected coding editors. [source link needed: Liu et al., AIShellJack]
Endo is a distributed JavaScript platform built on Hardened JavaScript. A guest in Endo starts with zero authority. It can use only the capabilities its host grants, and it cannot name, discover, or forge a reference to anything else.
An AI agent called Fae already runs this way, as a guest with a small set of built-in tools and the means to adopt new ones it is sent.
The demonstration we are building toward is a coding agent that reads and writes files in its own project directory, runs the build tools it was given, and talks to the person it works for. It cannot read credentials, reach other projects, or open network connections nobody granted. A prompt injection that hijacks the agent runs into the same walls.
The Familiar
The Familiar is a desktop app that puts Endo in front of people who will never clone a repository. It bundles the Endo daemon with a chat interface. Capabilities get pet names: your own human-readable names for the things you hold.
OCapN
OCapN is the wire protocol that carries capability references between machines and between organizations. It is how a grant crosses a trust boundary.
Endo's implementation pairs it with the Noise Protocol: Ed25519 keys identify peers and ChaCha20-Poly1305 encrypts the traffic between them. The protocol specification is a standards-track effort shared with the wider OCapN community.
What this doesn't do yet
None of this handles revocation the way organizations need it. Deciding at grant time whether a cut cascades or leaves long-lived arrangements standing is unbuilt, here and everywhere else.
Other research keeps arriving at capabilities independently, most recently Google DeepMind's work on capability-based enforcement for agents. We would rather back the approach that works than the one we started with.
