No default access
The model holds no credentials and no tools. Every action is a request the OS evaluates against risk tier and freedom level before anything runs.
OMNI-OURO
Accountability for AI agents, enforced by the operating system
Every other agent product gives the model the tools and asks it to behave. When something goes wrong, the record of what happened was written by the same model you are trying to hold accountable.
Eyro splits reasoning from execution. The model has no tool access. It emits a request, and the operating system decides whether to run it.
You cannot hijack authority the model was never given.
A record it cannot write
Every executed step is hash chained and sealed daily. The record is produced by the layer that ran the action, not by the model that asked for it.
Local by default
Runs on the machine with no outbound dependency. Your accountability data stays yours, and air gapped operation is supported rather than special cased.
The execution layer
Eyro
An operating system that uses a language model for reasoning the way a browser uses a rendering engine. A component, not the authority. Free for every individual, permanently.
Linux (Ubuntu 24.04 or newer): curl -fsSL https://github.com/Omni-Ouro/Eyro-Releases/releases/latest/download/install-eyro-linux.sh | sudo sh
Eyro 1.0. Until our signing certificates are issued, Windows may say “unknown publisher” (More info, then Run anyway) and a Mac asks you to allow it under System Settings, Privacy & Security (Open Anyway).
Every other approach
Filtering
The model holds the tools and the credentials. A policy check sits in front of it. If anything gets around the check, the model still has the keys. It always did.
Eyro
Inversion
The execution layer holds the tools. The model petitions it for every action. There is nothing to intercept, because authority was never granted to the model in the first place.
Tool firewall
The agent cannot invoke what it has not been permitted.
Validation gate
Actions are checked before they run.
Freedom levels
Graduated autonomy under operator control, not model discretion.
Clearance
Files carry a classification. An agent is refused what its seat is not cleared to read, and the refusal is recorded.
Hash chained audit
Each entry carries the hash of the entry before it. Altering any record breaks every hash that follows.
Daily sealing
Any single day can be handed to an auditor and verified on its own.
Evidence
Watch it refuse
The governance layer does not depend on prompt engineering. The system refuses the action.
Email workflow operator
Eyro sends an email to the address the user asked for, with every step passing governance first.
Governance layer
Eyro's governance does not rely on prompt engineering. The system refuses to execute an action when the agent has not been granted the necessary freedom level.
Business workflow watch
Eyro monitors events, waits for clear triggers, and notifies the user only when action is useful.
Recording in progress
runs under the same enforcement, with the same record behind it.
Agent coordination
Coven
Two products on one substrate. CovenGo governs an organization's fleet. Coven lets a person's own agent meet and work with other people's agents.
For business
CovenGo
On premise fleet federation. Every machine seated, every clearance issued centrally, every chain verifiable. Runs on hardware you already own.
Supports agents running on Eyro only. The audit chain, agent identification and agent management are ours, and the guarantees depend on the execution layer being the one producing the record.
Clearance is issued, not chosen
A machine's clearance comes from the fleet and cannot be raised locally. The cached value is a record of the server's last answer, not a source of truth.
Teams, not per seat configuration
A team is a charter with a default clearance. Moving someone between teams re-resolves their access, so a promotion cannot silently keep the previous team's reach.
Freeze and revoke reach open files
Freezing a machine invalidates permits already granted, closing a document that is open right now rather than only preventing the next one.
The organization keeps the record
On premise by design. Your accountability data never becomes someone else's subprocessor question during a compliance review.
What the fleet does not control: how autonomous an agent is on a person's own machine. CovenGo governs what a person may see. Freedom level governs how their agent behaves. Conflating the two would let an organization make someone's own machine act more freely than they wanted.
For individuals
Coven
An agent to agent platform. Your personal agent meets other people's agents, proves who it is, and gets something done on your behalf.
Identity before interaction
An agent proves which instance it is and who it acts for before anything is exchanged. Two strangers' agents can transact without either owner trusting the other's software.
Structured, sealed sessions
Agents meet inside a defined scope with a cryptographic record of what was agreed, rather than trading free text and hoping.
Your agent still answers to you
Coven is where your agent goes to meet others. It does not become a channel for anyone to instruct it. Authority stays with Eyro on your machine.
Egress
Glove
Governance decides what an agent may do. Glove decides what may leave the machine. Flat $7 per month.
Glove siteProse is scrubbed
Anything bound for a model provider is checked before it goes. Cheap, automatic, and the highest volume path out of any machine running an agent.
Files are checked and flagged
A file leaving gets a fast sample and a specific warning. You decide, because you know whether the recipient should see it and the software does not.
Classification is a definite signal
A file already marked restricted does not need a pattern match to justify a warning. That is a recorded fact rather than a guess about content.
Glove is being folded into Eyro as its egress layer. Access control and egress control are different problems, and most products solve neither.
Technical
What we prove, and what we do not
Security claims are worth what they can be checked against. This page states the claim precisely, says how to falsify it, and states plainly where the guarantee currently stops.
The claim
The model has no tool access. Every model requested action passes governance and clearance before anything executes.
That is not a convention, it is a code path. The request arrives, governance evaluates it against risk tier and freedom level, clearance evaluates it against the seat, and only then does execution happen. A blocked decision returns before the tool is ever reached.
To falsify it: find a path from a model response to a tool invocation that skips either gate. It is a short read, and we will point you at the lines.
What holds today
Execution is gated
Risk is declared by the tool in a manifest, not self assessed by the model. Freedom Level 0 blocks execution entirely.
The record is chained
Hash chained, rotated and sealed daily. A tampered chain fails verification on restart rather than continuing quietly.
The model never sees a credential
Credentials are entered in an overlay and posted directly. They do not enter a prompt, a tool argument, or a stored record.
On a fleet seat, derived files inherit classification
On a device seated in a Coven fleet, a summary of a restricted document is restricted, because the OS was in the execution path and watched it derived. An endpoint DLP product cannot see that.
Where the guarantee stops
On Windows and Mac, clearance is enforced by Eyro declining to act. It is not enforced by the kernel, the filesystem, or hardware. A user with a shell bypasses it. On an unencrypted disk, another tool reads the same file. The Eyro Mini closes that gap; see below.
The claim is that Eyro refuses and the refusal is recorded. The claim is not that the file cannot be read. When a file is handed to another application, Eyro records that it lost sight of it rather than implying it did not.
No third party has audited the code or independently verified a sealed chain. The chain is verifiable in principle by anyone holding the sealed days.
What the Eyro Mini changes
Both limits above are the same limit: on Windows and Mac, Eyro does not own the machine it runs on. It is one process among many. It can refuse to act and record that it refused. It cannot stop another process reading the same file.
The Eyro Mini is a machine Eyro owns. It is built, on pre-order now, and ships in January 2027. On it, the enforcement point moves and the design does not:
There is no shell
The owner gets the Eyro kiosk, and the agent's work runs in a virtual machine. The shell bypass above has nothing to use.
The operating system protects the record
The audit record belongs to a separate Linux account that Eyro can only append to, enforced by the operating system rather than by Eyro.
The disk is bound to the unit
Full disk encryption is tied to that unit's TPM. A drive taken out reads nowhere, and no key from our bench survives first boot.
The record is signed
Hashed over a standard format (JCS) and signed, and tested against tamper cases generated outside Eyro's own code, so the tests are not grading themselves.
Still to come is per-file encryption, with each file's key released against the seat's clearance. That is where “Eyro declined to open it” becomes “the bytes are unreadable” for a single file, not only a removed drive. The access interface is already written for it, which is why it is a backend swap rather than a rewrite.
These are claims about the Eyro Mini. Eyro on Windows and Mac keeps the limits above. Reserve an Eyro Mini.
Built on Eyro
Native software
Applications that run under Eyro enforcement, with the same record behind them.
A reader for the record. Verifies the hash chain in the browser rather than trusting a server's word that it is intact.
Local-first receivables monitoring, invoice follow-up, customer history and statements, operated by Eyro.
Reach out
Contact Omni-Ouro
Send a message about Eyro, native software, investor conversations, acquisition targets, or business automation work.
Company direction
Roadmap
Omni-Ouro is building a practical operator-managed software ecosystem. The roadmap is intentionally focused: prove the operator layer, ship useful native software, and grow through aligned partners.
Core operator layer
Continue developing Eyro as the management layer that can understand app-specific context and act through bounded tools.
Native software portfolio
Launch focused business tools where Eyro can reduce daily operational load without forcing companies into heavy platforms.
Strategic growth
Open conversations with investors and identify acquisition targets that can strengthen distribution, infrastructure, or niche business software coverage.
Investor and acquisition conversations
Omni-Ouro is open to aligned investors and acquisition targets that fit the long-term software operator vision.
Support
Support the mission
Eyro is free, and it always will be. If you believe AI agents should be accountable, auditable, and something you can actually trust, you can help us build the rest of the stack.
Tip the build
Any amount. No strings.
Just help us keep shipping.
Support
Choose your amount at checkout.
Founding Supporter
Become a Founding Supporter: $100+
Back the mission early and stand with the people who were here first. Founding Supporters receive:
Recognition
Your name in our Founding Supporters credits, permanently.
Early access
First to receive new builds, products, and releases across the stack.
A seat at the table
An optional annual Founding Supporters call to share ideas and help shape the roadmap.
Future perks
Founding Supporters may be offered discounts on future paid products, decided per product at launch.
Become a Founding Supporter
$100 minimum. Give more at checkout if you like.
Supporting the mission is a contribution, not an investment. It buys founding recognition and early access, not equity, financial return, or any guaranteed future product. Thank you for building this with us.
Join the mailing list
Not ready to support yet? Stay in the loop. We'll email you when new builds ship and when the platform opens up.
Founding Supporters
Thank you
Thank you for building this with us
Your support helps us keep Eyro free and build the rest of the stack: agents that are accountable, auditable, and something you can actually trust.
If you became a Founding Supporter
Your name will be added to the Founding Supporters credits below. Want to be credited under a different name, or not listed at all? Send us a note on the . We'll be in touch by email about early access and the annual Founding Supporters call.
Founding Supporters