Kepil is an accountability layer for AI agents, designed to provide agents with identity, authorization, execution, evidence, and revocation capabilities. According to its official materials, 53% of organizations have encountered AI agents exceeding expected permissions, 48% of production agents have no monitoring at all, and only 22% treat agents as entities with their own identity. Kepil is designed precisely for the part missing in the remaining 78%.
Main Capabilities
Passport: Each agent version receives an immutable card recording the builder, operator, capabilities, actions it will never perform, risk level, autonomy level, limits, and risk review time. A new version generates a new card, and old cards are permanently retained.
Mandate: A machine-readable authorization document for a single task, including allowed actions, allowed systems, spending limits, validity window, and which action types must be confirmed by a human. Anything not explicitly allowed is denied.
Gate: The sole entry point for interaction between the agent and the outside world. Every action is checked against the mandate before calling the model. Fail closed: any error during the check means denial, never pass.
Journal: An append-only JSONL file, where each record carries the hash of the previous record. Editing or deleting records can be detected, and anyone can verify it using an independent implementation.
Undo: The journal is a graph structure of actions, and each profession declares its compensating action. Kepil traverses the graph backward and stops honestly at the first step that cannot be undone.
Phone Confirmation: Irreversible actions are sent via Telegram, with two buttons for approve or return, so accountability does not require sitting in front of a laptop.
How to Use
Kepil provides an MCP server, through which editors, assistants, or other agents can work, and every action still enters the same journal through the same gate. Seven tools are provided: list professions, create order, run step, read order status, view what is waiting for human handling, verify journal, read agent passport. One tool is deliberately missing: confirm. If the model could approve irreversible actions, humans would be out of the chain, and the entire design would lose its meaning. Confirmation cards are sent to humans (panel or Telegram), and no MCP client can press them.
Kepil also provides a small JSON API, so n8n workflows, Make scenarios, or custom scripts can request permission before execution.The answer is recorded in the journal so that the basis for automated execution or non-execution can be shown later. n8n has a ready-made node: n8n-nodes-kepil. The API is disabled by default until a token is set (panel → settings, or KEPIL_API_TOKEN).
python -m kepil.admin Open the operator console: orders, professions, agent passports, meters (actions, tokens, cost, substituted human time), compliance generators, logs with chain verification and anchoring, and settings. State is plain JSON files under KEPIL_DATA (default ./data), no database.
Applicable Scenarios
Suitable for organizations that need accountability and auditing of AI agents, including inbound leads, process automation, bookkeeping documentation, AI adoption audits, public procurement packages, and other professional scenarios. Also suitable for teams that need to protect existing automation (such as n8n, Make).
Limitations
- Agents are never fully autonomous: AgentPassport refuses to build autonomy levels where humans cannot cancel decisions; this is an architectural limitation.
- Records after the last witnessed head in the logs are unprotected; the guarantee stops here.
- About one-fifth of compliance investigations can be closed automatically; the rest require human answers.
- The verifier is an independent implementation in another language.
- The project is in Alpha with 170 tests; interfaces may change.
- Not legal advice; consult a lawyer before relying on generated documents.
- AGPL-3.0-or-later licensed; running a Kepil-based network service requires releasing the source code under the same terms or obtaining a commercial license.
- Core has zero dependencies, based on the Python 3.11+ standard library; CI fails when third-party imports appear.
- Values never enter the logs, only types, counts, and hashes.
