Model Weight Protection and Agent Governance Demos

Quick start

git clone https://github.com/agentrust-io/demos && cd demos
pip install -r requirements.txt
export CMCP_BEARER_TOKEN=demo-token
python demo.py            # all ten, pausing before each
python demo.py 6          # just demo 6

The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. Source: github.com/agentrust-io/demos.

Model Weights

Securing model weights

A fine-tune trained on your own data is IP that never existed publicly, and the weights are where it lives. These four demos treat the weights as the asset: bind the exact checkpoint, release the decryption key only into a serving stack that proves what it is, and keep the lineage of every derivative verifiable back to its base.

The honest limit, stated up front. Against an adversary who physically owns the silicon, no current confidential-computing platform is custody-grade. TEE.fail and BadRAM are the reason. What these demos give you is accountability-grade custody under an operator-trust model, plus a threshold scheme (demo 9) for when one operator's word is not enough. Anyone selling you weight protection "without operator trust assumptions" is overstating what the hardware does.

Demo 6Weight custody~60 seconds

A Weight Custody Manifest binds the checkpoint's exact weights_hash, gates the decryption key behind attestation, and carries the fine-tune's lineage.

a manifest jointly signed by builder and custodian binds the exact weights_hash, and the signature verifies
the attestation gate releases the key only for the certified serving stack: genuine nonce, approved platform, signed image measurement
a tampered checkpoint's hash does not match, so it is refused before it ever loads
a fine-tune verifies as a derivative back to the signed base

python demo-06-weight-custody/run.py

Demo 7Closed-weight custody~60 seconds

The mirror of demo 6. Here the base model is closed, a frontier lab shipping weights into a customer's or a sovereign's own enclave, so the weights themselves are the secret and the job is keeping the key off the operator.

a manifest with base_confidentiality: confidential, jointly signed by lab and customer
the key releases only into the attested, lab-signed serving stack
an unapproved stack, one that could export plaintext weights, is refused the key
same protocol as demo 6, different job

python demo-07-closed-weight/run.py

Demo 8Derivative lineage~60 seconds

Fine-tune inside the enclave on private data and the result is novel IP. It gets its own signed manifest with a derived_from pointer and a rights_holder split.

a base permitting fine-tune-only, and a derivative permitting none
verify_lineage resolves the derivative back to the base: chain, depth, root
the rights_holder records the base and derivative IP split
rights are monotone, so a fork of the no-derivatives derivative is rejected

python demo-08-derivative-lineage/run.py

Demo 9Sovereign threshold~90 seconds

This is the answer to the limit in the callout above. If a hardware owner who forges one attestation could release a key, then never let one release be enough.

the model key is split 2-of-3 across the lab, the sovereign authority, and the customer
a single share reconstructs nothing, so one forged attestation sits below threshold
two independent shareholders each attest and release their share
forging now means forging attestation to a quorum of independent roots, not one

python demo-09-sovereign-threshold/run.py

Agent Governance

Governing what an agent does

Demos 6 to 9 protect the weights. These five govern the tool boundary: what the agent is allowed to call, under which workflow, with what compliance attributes, and what evidence survives afterwards. Cedar policy is enforced on every call and each session closes with a signed TRACE claim.

Demo 1cMCP in action~90 seconds

An agent calls three tools through the cMCP gateway. Cedar is enforced on every call, and the session closes with a signed TRACE claim carrying the policy bundle hash.

write_file and read_file allowed, real files written to workspace/
list_dir denied by policy: HTTP 403, POLICY_DENY
the claim carries runtime.platform, runtime.measurement, policy.bundle_hash
on real Intel TDX the bundle hash flows into RTMR[2] at startup

python demo-01-cmcp-in-action/run.py

Demo 2Policy swap is an attestation failure~90 seconds

The operator quietly loads a different policy bundle. The claim's hash changes, and a verifier pinned to the old hash rejects it.

v1 and v2 bundle hashes printed, visibly different
write_file now denied under v2
verifying a v2 claim against the pinned v1 hash fails with POLICY_HASH_MISMATCH
on real TDX the measurement itself changes, not just a field

python demo-02-policy-swap/run.py

Demo 3Offline TRACE verification~60 seconds

Verify the signed claim with no gateway, no server, and no network call at all.

schema, signature, policy hash, catalog hash and audit chain all check out
hardware_attestation stays in unverified_fields in software mode, so the status reads partially_verified
on real TDX that field verifies too and the status becomes verified
no connection is made to anything

python demo-03-offline-trace/run.py

Demo 4Context-aware enforcement~90 seconds

The same tool, the same arguments, allowed in one workflow and denied in another. Authorization tracks the declared call context, not the tool's name and not the model's stated intent.

write_file under workflow_id="invoice-run": allowed
the identical call under workflow_id="chat-freeform": denied, default-deny holds
read_file still allowed in both, so only the write capability is scoped
both the allow and the deny land in the signed audit chain

python demo-04-context-enforcement/run.py

Demo 5Attribute-based enforcement~90 seconds

Deny on the tool's compliance attributes rather than its name. A tool that is not BAA-covered is refused by one guardrail rule, whatever it is called.

tools tagged compliance_domain=clinical, baa_covered=true: allowed
a tool tagged baa_covered=false: denied
the deny comes from forbid ... when { context.baa_covered == false }, overriding the baseline permit
one rule covers every non-covered tool in the catalog, present and future

python demo-05-compliance-domain/run.py

Demo 10Governed model calls~90 seconds

Put policy in front of an OpenAI-compatible model endpoint and route each request according to its data class.

public prompts can use the shared model route
PII leaves only after identifiers are stripped
confidential and PHI prompts stay on approved regional infrastructure
the same governance boundary applies to model calls, not only MCP tools

python demo-10-model-gateway/run.py

Where to go next

Demo source on GitHub, including a web console and a plain JSON-RPC test server
weight-custody-manifest on PyPI, the reference SDK behind demos 6 to 9
Worked WCM examples
cMCP and TRACE specifications
The ten-minute cMCP quickstart if you would rather write the policy yourself

Don't take the spec on trust.Run it.

Quick start

Securing model weights

Governing what an agent does

Where to go next

Don't take the spec on trust.
Run it.