Auren — The last-mile guardrail for AI agents

How it works

Enforcement lives below the browser.

Prompt guardrails argue with the model. Auren sits where agents actually act — a DNS NXDOMAIN and a dead tunnel don’t negotiate.

DNS blocking

Blocked domains answer NXDOMAIN in every app and browser — including headless ones.

OS firewall

Command ports, DoH endpoints, and cloud-metadata IPs die at the OS layer. Tunnels and “Secure DNS” bypasses fail.

App blocking

Blocked apps are killed the moment they start — and kept stopped — no matter what launched them.

Autofill & HTTPS hostnames

Saved credentials can’t be auto-filled. A loopback proxy refuses blocked HTTPS hosts by name — never decrypting.

AI agent any browser / app / terminal Auren resolver 127.0.0.1

blocked → NXDOMAIN everything else → real DNS

Protection Mode

One switch. Your fingerprint holds the key.

Turning protection on is instant. Turning it off — or quitting — needs your fingerprint plus a 5-second cooldown. An agent can’t quietly undo it.

Flip it on. First run installs the background service (one admin prompt); every later flip is instant.
Work normally. Allowed sites, apps, and files behave exactly as before.
Agents hit the wall. Blocked lookups fail, tunnels die, exfil pipelines get denied before they run.

Auto-protect Beta

Auren spots live agent sessions — headless browsers, automation drivers, CLI agents — and raises protection itself. It only ever raises it; lowering it is always your fingerprint.

File System Guard

Agents see exactly one folder. Yours.

Mount a workspace and every agent file request is checked — symlinks and ../ collapsed first, secrets always denied, everything else contained to your mounts.

Default-deny mounts

The agent starts with zero file access. Only folders you explicitly mount are visible through Auren’s gates — stored encrypted, locally.

Forced exclusions

.env, .ssh, .aws, *.pem / *.key, browser credential stores — always denied, even inside a mount. Never removable.

Traversal-proof

Symlink escapes and workspace/../.env tricks collapse to their real location first — then get denied.

Honest scope: the guard covers agent file access routed through Auren (loopback bridge, terminal-command gate, path checks). It doesn’t lock Finder / File Explorer for you — you stay trusted; the agent stays leashed.

Agent Detection

Know when software is driving your computer.

A fully local, deterministic detector watches for evidence of automated control — known agent processes, accessibility/automation API use, programmatic input, and repeated automation patterns — and scores it transparently. No cloud, no ML model, no screen recording, no keystroke logging. Metadata only, always offline.

Evidence, not black boxes

Every detection lists its reasons — “known agent process”, “accessibility automation observed”, “programmatic input” — with a score that decays over time. A score of 80 means the evidence crossed a threshold you can inspect, not a probability.

Detection advises, policy decides

Detections map to ALLOW, WARN, REQUIRE_APPROVAL, or BLOCK. An agent plus a sensitive operation asks for your approval first — unknown automation at low confidence is simply allowed.

Private by construction

No typed text, passwords, clipboard, screenshots, or document contents are ever captured — only timestamps, event types, and process metadata in ephemeral memory. Debug logging is metadata-only and off by default.

Honest scope: the detector answers “is there sufficient local evidence of automated control?” — it never claims which AI model is behind it, what it intends, or that a process name alone proves anything.

Try it live

Poke the gates. They bite.

A simulated preview of Auren’s real decisions. Flip the switch, then type a command or a path — watch what gets through.

Protection Mode

ON — only what you allow is reachable

Blocked sites

chase.com
gmail.com
icloud.com

Risky agent action blocked

agent — command gate

agent — file guard · mount: Passwords

Simulated in your browser for the demo — the real gates run locally in the app with full canonicalization.

Privacy

Zero-knowledge. Local-only.

No telemetry, no account, no cloud. Your policy lives on your disk, encrypted (AES-256-GCM) and signed — verified on every poll.

No file contents or full paths ever logged — basenames and labels only
Biometrics never touch Auren — only pass/fail from Touch ID / Hello
Fail-closed: if enforcement can’t be verified, gates refuse by default
Activity log is append-only, on your disk, readable by you

Honest limits

What Auren does not claim.

Not a Finder/Explorer lock — it leashes agents, not you.
Not a sandbox — unlisted processes run freely; app blocking is an exact-path kill-loop.
Not content inspection — the HTTPS proxy reads hostnames only, never payloads.
DoH blocking covers known endpoints; a self-hosted resolver isn’t on the list.
Assumes a non-compromised machine — root-level attackers are out of scope.

FAQ

Questions, answered.

How do I install the unsigned beta builds?

Mac: open the .dmg (Apple Silicon, or the Intel build), drag Auren to Applications, then right-click → Open on first launch to bypass Gatekeeper once. If macOS still says the app is “damaged”, run xattr -cr /Applications/auren.app in Terminal and reopen. Windows: unzip the portable build and run auren.exe, then SmartScreen → “More info” → “Run anyway”. Signed builds are on the roadmap.

Which platforms are supported?

macOS (Apple Silicon and Intel) and Windows 10/11. Protection uses the pf anchor on macOS and firewall rules on Windows; DNS, proxy, autofill, and agent gates work on both.

Will it break my normal browsing?

No. Allowed sites resolve and load exactly as before. Only domains, apps, and ports you block are affected — and flipping protection OFF restores everything within about a second.

Does the File Guard lock my own folders?

No — you can always open anything in Finder/Explorer. The guard constrains what AI agents can read through Auren, so secrets outside your mounted workspace stay out of agent reach.

What happens if something goes wrong?

Auren fails closed: if the background service stops responding or its integrity can’t be verified, every gated surface refuses by default and the app shows a degraded banner with a one-click service reinstall.

Is there a price / subscription?

The beta is free. A subscription with synced policies across machines and a cloud dashboard is planned — your local-only posture stays the default.

The last-mile guardrail for AI agents.