eunomia-bpf / ActPlane

What is ActPlane?

ActPlane is an OS-level enforcement layer for AI agents that uses eBPF to observe and enforce behavioral rules written in YAML. Instead of relying on probabilistic prompt constraints or tool-layer guards that break when agents shell out to bash or spawn subprocesses, ActPlane sits at the kernel level where every exec, file open, and network connect is visible regardless of how the agent reaches it. The policy language lets you express constraints like "nothing descended from this agent may run git branch" or "data read from .env files cannot leave the workspace" -- rules that follow process lineage and data flow, not just individual operations. When a rule fires, the kernel kills the action and feeds a human-readable reason back to the agent so it can self-correct. Written in C for the eBPF engine and Rust for the collector that compiles policies into kernel config.

Why is it gaining traction?

The core insight is that existing agent constraints are all bypassable at some layer: prompts get ignored, tool gateways fail when agents call subprocess directly, and sandboxes are all-or-nothing. ActPlane fills this gap by operating below the tool layer entirely. The policy language is expressive enough for real workflows -- causal ordering ("run tests before committing"), data-flow constraints ("secret data must not reach the network"), and lineage tracking ("this entire subprocess tree cannot touch git") -- while still being simple enough that agents can write and validate their own rules with `actplane check`. The corrective feedback loop (violations tell the agent why and how to retry) is what separates a harness from a sandbox.

Who should use this?

Security-conscious teams deploying AI agents that handle sensitive code, secrets, or external network access will get the most value. If you're running Claude Code or Codex in environments where you need guarantees beyond what CLAUDE.md files can provide, ActPlane enforces those guarantees deterministically. Platform teams building multi-agent systems where one agent might call another across vendor boundaries will benefit from OS-level confinement that doesn't depend on framework-level guards. It's also relevant for teams with compliance requirements -- the audit trail from violations provides evidence of policy enforcement.

Verdict

ActPlane solves a real problem that most teams haven't fully grappled with yet: how do you constrain agents that can bypass every existing control layer? The architecture is sound and the policy language is well thought out. However, with 14 stars and a 1.0% credibility score, this is early-stage software. The eBPF dependency means Linux 5.8+ with BTF, and block mode requires BPF-LSM enabled -- practical constraints that limit immediate applicability. If you're evaluating this for production use, treat it as a promising prototype that needs community validation before betting your security posture on it. Watch the project, run the examples, but don't ship it without thorough testing in your specific environment.