Provos built Iron Curtain so a fixed policy, not a model, limits what an agent can do

Niels Provos built Project Iron Curtain so that a fixed policy, not an AI model, decides what an AI agent may do. Provos co-authored the bcrypt password method. He explained the design on GitHub's podcast, in an episode published on 13 November 2026.

What was said

Provos was discussing agents such as OpenClaw, which people hand tasks like calendar handling and outreach. He called OpenClaw fascinating and a fun idea. But he warned that many of the skills, meaning add-ons an agent can use, may be malicious. He said you probably do not want an agent that holds all your privilege, and that it does not end well.

Asked how he would build one with security first, he thought of writing a plain-English constitution, his own word for it. A language model questions that text over several steps and writes a deterministic policy from it. He also wanted the policy built on something semantically meaningful. The excerpts do not define that term.

He ruled out a model as the guard for a stated reason. As he put it, "if you use them as the guardrails for what the agent does, you don't really know what they're going to say is good or bad."

Here is a plain-words explanation, which is WebPulse's and not Provos's. A deterministic policy is a fixed set of rules. The same action gets the same verdict every time. A model judging case by case can answer differently each time. A cleverly worded request might also sway it. A fixed rule has no wording to argue with. The excerpts do not say where the policy sits relative to the agent.

A model still writes the policy. Asked whether he trusts models to read plain English the same way each time, Provos said no. So a person looks at the finished policy and signs off. He added that the system by and large produces very reasonable policies.

Why it matters

Our reading: this moves the human's job. Nobody hand-writes every rule. A person reads a generated policy and judges whether it matches what the business intends. That is judging, not making.

Our argument: a named approver gives an organisation someone to hold to account. That only holds if the review is real. A signature does not prove the signer understood the policy.

The other side

Provos described how he built his own project. He did not say every agent needs a human-signed policy, or that a model must never be involved. Iron Curtain is also his own work, and he said he would love more people to try it.

The conversation did not show how often reviewers catch a flawed policy, how long these policies run, or how people would be trained to review them. It gave no comparison with model-based guardrails. Wider use would be an invitation to test the idea, not evidence that it works.