How Ennius works
The layer an agent runs inside.
Ennius decides what an agent is allowed to touch, holds what it has learned in a form you can audit, and keeps the record of what it did. It runs on your machine. This page is the long version.
What it is
Every agent needs somewhere to run.
Modern AI agents do more than answer questions. They run commands, edit files, call other services, and make changes that outlast the conversation. To do any of that an agent needs somewhere to run — a layer that decides what it is allowed to touch, holds what it has learned, and keeps a record of what it did. That layer is called a harness. Ennius is ours.
Most harnesses are built around what an agent can do. Ennius is built around what it should be allowed to do, and what it can account for afterwards. That is a narrower question, and answering it well is what makes the wider one safe to answer generously.
Where this is going: you should be able to hand an agent real credentials, walk away, and come back to an account of what it did — not a summary the agent wrote about itself, but a record the system kept whether or not the agent cooperated. You should be able to say what it may never touch, once, and have that hold three delegations deep. And when it learns something about how you work, that should belong to you — a file you can open, read, and take somewhere else.
Four properties get us there. Where any of them conflicts with a capability, the capability gives way.
The four properties
What Ennius will not trade away.
-
Authority is explicit, and it narrows
Every agent runs inside a stated grant of what it may touch. Nothing is implicit and nothing is inherited by default: if a permission was never issued, there is no path by which an agent acquires it. When work is delegated onward, the grant that travels with it is a subset of the one above — so authority contracts as it moves rather than spreading sideways, and an agent several steps removed from you is strictly less powerful than the one that sent it, never more.
At the edge of what it holds, an agent asks rather than improvises. That is the whole behaviour: the interesting failures are not the ones where an agent is blocked, but the ones where it quietly finds another way round.
-
Memory is a ledger, not a bucket
Every record carries where it came from, how sure it is, and what it replaced. Something you said and something the model inferred are stored as different kinds of thing and never quietly become the same thing — which matters because the second kind compounds. An agent that can write unfounded claims into shared memory degrades every session that comes after it.
Corrections supersede rather than overwrite, so what was believed, and when, survives being wrong about it. Where two people contradict each other the disagreement is arbitrated on the record rather than settled by whoever wrote last. You can ask why it believes something and get an answer with a provenance attached.
-
It runs on your machine
Ennius is local-first. What it remembers lives in a file on your own disk, in a format you can read without our software and take elsewhere without asking us — private from the moment it is written, not private by policy.
Nobody should have to rent their own history back, and nobody should have to take it on faith that a copy held somewhere else is being looked after. The way out stays as wide as the way in, because loyalty should be earned rather than engineered.
-
It can account for what it did
Every action is attributable after the fact: which agent, under which grant, on the strength of which memory. The trail is append-only and it is written as the work happens, so it is the record itself rather than a report compiled afterwards by the thing being reported on.
This is the property the rest of the design exists to protect, and the one we are least willing to trade. Software that can act on your behalf but cannot say what it touched and on whose authority is not powerful. It is unaccountable.
Every one of these costs something to build and would be easier to skip. We are building them anyway, because an agent you cannot check is not one you should be running.
Who builds it
Who you would be dealing with.
- Product
- Ennius — in active development. There is nothing to download yet.
- Built by
- Awakened Labs Inc., a Delaware C corporation incorporated 2026
- Location
- Gilbert, Arizona, United States
- Founders
- David Hawkes and Jeremy Windsor — full biographies
- Contact
- Send us a message
If you are facing these challenges now, tell us.
The most useful conversations we have are with people already thinking about what it takes to let an agent work unattended.