Open trust infrastructure
Trust, authorization and verifiable execution for humans, AI agents and digital organizations.
Give an agent a permit instead of a key. Decide with rules instead of a code review. Ask a person when it matters, and afterwards be able to prove what happened — to somebody who does not trust you.
What Bengar is
Software increasingly acts on its own — an agent books, buys, refunds, moves money. The usual answer is to hand it a credential and hope the prompt holds. A credential has no idea what it was given for, so the blast radius of a mistake is everything that credential can reach.
Bengar replaces the credential with bounded authority: a signed document saying what may be asked for, deterministic rules saying what may happen now, a human in the loop where the rules say so, and a record afterwards that a third party can verify.
The core trust flow
Authority is the meet of these, never the sum. A permit cannot widen a policy, a policy cannot widen a permit, and an approval satisfies a condition rather than granting anything.
Authorizing an AI agent
An agent presents a permit and asks. It never holds a spending key — the thing that can move value is on the other side of the request, and it checks.
Bounded, not trusted
“Purchase, from procurement, under 5,000 ₺, until Friday” is a document. A compromised agent can ask for more and be refused.
Stoppable
Freezing an agent applies to the next authorization, so one behaving badly does not get to finish what it started.
Accountable
Every decision is recorded with its reason, and every record can be checked against an anchor.
Organizations
Roles are separated because separation is the product. An administrator cannot approve, cannot author policy and cannot register a permit — deliberately, so that whoever configures the controls is not also the person they constrain.
Bengar Trust, Bengar Network, Bengar Assets
Three things, related and not the same. Reading them as one product is the fastest way to misunderstand what any of them does.
Bengar Trust
Identities, permits, policy, approvals, execution and proofs. It works with no chain at all.
Bengar Network
A Cosmos SDK chain that witnesses the audit trail and carries accounts, staking and governance. It is not in the authorization path.
Bengar Assets
Issued tokens with a fixed or capped supply, optionally requiring a Trust authorization before they move.
The applications
Bengar Console AVAILABLE
The control plane a person signs into: what agents were authorized to do, and what is waiting on a human.
Bengar Scan AVAILABLE
The public explorer: blocks, transactions, accounts, validators, assets, and the Trust records anchored on chain.
Bengar Wallet PREVIEW
A personal wallet for the Bengar network. The key stays in the browser.
For developers
One call decides. The decision is a value, not an exception, and it has three possible answers — only one of which means go.
const decision = await bengar.authorize({
agent: "did:key:z6MkProcurement",
permit,
action: "purchase",
resource: "resource://company/procurement/laptop",
amount: { minor: 500_000, currency: "TRY" },
});
// "ALLOW" | "DENY" | "REQUIRE_APPROVAL"
// REQUIRE_APPROVAL is not an allow.
if (decision.decision !== "ALLOW") return;API reference · SDK · CLI
The security model, in five lines
- Fail closed. A dependency that cannot be reached produces a refusal, never a permissive default.
- No universal administrator. ADMIN is not implicitly every role, and no module can act on everyone.
- Semantic signing. Custody accepts an operation from a closed set and builds what it signs. No caller can hand it bytes.
- Tenant isolation. Another tenant's identifier gets the same answer a typo does.
- UNKNOWN is not FAILED. An outcome nobody observed is held for a person, never retried automatically.
Where this actually stands
26 capabilities are usable today. Several more are built and reachable only through the API, and the capability index says which is which — including the ones that are implemented and still not usable, and why.
Working
Authorization, policy, permits, execution and audit through the API. The Console for reading everything, API keys, freezing agents, reconciliation and audit.
Honest gaps
No screen grants a role, so anything needing APPROVER, POLICY_AUTHOR or PERMIT_ISSUER is set up out of band. Passkey enrolment has no screen yet.
Not there
No public testnet and no mainnet. Real multi-host network validation is an open gate. Test coin has no value.
Architecture and roadmap
How the pieces fit together — the Gateway decides, Custody signs, the Indexer derives, the chain witnesses, and each of those is a separate boundary on purpose.
What is next, with milestone statuses that match the repository rather than a plan.
Start
Four commands get you a permit you can verify offline. Seven more get you a real ALLOW, a real DENY and an approval obligation from a running service.