CFAM

CFAM is a project of GALXEE AI, developed in collaboration with Threat Tape. GALXEE owns the design; this is the working reference implementation of it. It is in active development, not a shipped product, and the repository is deliberately described by its own authors as the honest build rather than the demo build.

The premise is a narrow one. When an AI agent decides to do something, that decision is a recommendation. Most agent frameworks treat it as an authorization — the model reasons its way to an action and the action simply happens. CFAM sits between the two. Every proposed action passes through four stages, in order, with no bypass, and the agent does not get a vote on whether it is subject to them.

Policy before intent. A deterministic allowlist checks each action against a signed capability manifest: which tool, which endpoint, what cost, what time window, which recipient domain. It makes no attempt to infer what the agent meant. It enforces what the task was authorized to do, which is the only boundary that still holds when the model is wrong, confused, or has been talked into something by its own input.

Risk scored without another model in the path. A transparent multi-signal analyzer — offline, no ML, no LLM — scores content for instruction-override attempts, data exfiltration, destructive operations, sensitive-data movement, obfuscation and scope drift. Under 30 allows, 30 to 69 escalates, 70 and above blocks. Every signal that fired is recorded with its weight and a human-readable reason, so a decision can be argued with rather than merely trusted. A judgement you cannot inspect is not a control.

Isolated execution. Code-execution tools run in a constrained subprocess with CPU, memory, process, filesystem and wall-clock limits, an isolated temporary directory and a stripped environment. Everything else is policy-gated.

A record that shows tampering. Every decision lands in an append-only, hash-chained audit ledger. Altering a past entry breaks the chain and the break is visible — which is the difference between a log you keep and a log you can rely on when someone asks what the agent did and why it was allowed to.

The interesting problems here are not the model’s. They are custody of the signing keys, what is guaranteed structurally versus what depends on how you deploy it, and what an operator can actually prove afterwards. Those are old security problems wearing new clothes, which is roughly why this collaboration exists.