Action-level authorization for physical AI
物理 AI 的动作级授权与审计
Before a robot acts,
KineGrant decides if it may.
机器人在动作之前，
由 KineGrant 决定它是否被允许。
KineGrant is an open-source authorization and accountability layer for robots and physical AI. Immediately before an actuator moves, it verifies a short-lived, one-time capability bound to the exact agent, target, action and purpose. After execution, it produces a signed, verifiable receipt.
KineGrant 是给机器人和物理 AI 的开源授权与审计层。在执行器动作之前，它验证一张绑定到具体主体、目标、动作和用途的短期一次性能力凭证；执行之后，生成可验证的签名收据。
The problem
要解决的问题
AI can call tools. The physical world can't be rolled back.
AI 能调用工具，但物理世界无法回滚。
Why this door, this once?
为什么开这扇门、这一次？
When a model says "open the door", who decided it may open this door, this one time?
当大模型说“开门”，谁决定它可以开这一扇门、这一次？
Who authorized it?
谁授权的？
After an action happens, how do you prove who authorized it, when, and for what?
动作发生后，如何证明是谁、在何时、授权了哪个动作？
Can it be replayed?
会不会被重放？
Once permission is revoked, can an old capability still be used again?
权限撤销后，旧凭证还能不能被再次使用？
Core properties
核心特性
Deny by default, single-use, receipt-backed.
默认拒绝、单次授权、执行留证。
Short-lived capabilities
Expire in seconds, one-time use.
几秒过期，用完即废。
Default deny
Anything not explicitly allowed is refused.
没明确允许的一律拒绝。
Replay protection
A capability cannot be reused.
同一凭证不能重复使用。
Signed receipts
Verifiable audit records after every action.
每个动作后有可验证的签名收据。
Receipt chains
Audit log survives restarts.
审计日志串成链，重启不丢。
Post-quantum
ML-DSA-65 signatures.
ML-DSA-65 后量子签名。
Cross-protocol
Adapters for ROS 2, Matter, OPC UA.
对接 ROS 2、Matter、OPC UA。
Offline verify
Zero-dependency browser verifier.
零依赖浏览器离线验证。
How it differs
与同类方案的区别
| Project | Covers | 覆盖 | Missing | 缺失 |
|---|---|---|---|---|
| OPA / Cedar / SpiceDB | General policy authorization | 通用策略授权 | No single physical-action semantics, no post-execution receipt | 没有单次物理动作语义、没有执行后收据 |
| ROS 2 SROS2 / OPC UA / Matter | Identity, transport, device security | 身份、传输、设备安全 | No action-level short-lived tokens and audit loop | 没有动作级短期令牌与审计闭环 |
| MCP / Agent tools | AI tool invocation | AI 调用工具 | No physical execution gate | 没有物理执行门禁 |
| Vendor robot security | Single vendor, single stack | 单厂商单栈 | No cross-stack open protocol | 没有跨栈开放协议 |
Security & certification
安全与认证
OpenSSF Best Practices
Passing badge achieved.
已通过（passing）。
OSS-Fuzz
Submitted to Google, build passing.
已提交 Google，构建通过。
Built-in checks
CodeQL, Scorecard, Dependabot, secret scanning.
CodeQL、Scorecard、Dependabot、密钥扫描。
Honest note: this is an experimental open draft. It has not undergone an independent security audit, is not a safety certification, and must not be the sole safety control for real machinery.
诚实声明：这是实验性开放草案，尚未经过独立安全审计，不构成安全认证，不可单独作为真实机器的唯一安全控制。
Want to validate it in your stack?
想在你的系统里做技术验证吗？
Free, no-fee technical validation — a remote demo is enough to start. Apache-2.0, no vendor lock-in.
免费、不收费的技术验证试点，远程接入 demo 即可开始。Apache-2.0，不锁厂商。