ALGOL
Agent authority infrastructure · London · algol.cc
AI agents, CI/CD workflows, tools, secrets, and delivery systems are gaining authority faster than organisations can govern it. Algol maps how authority moves through real workflows and turns that into evidence security, platform, and audit teams can use.
Install it, scan a real workflow, inspect where authority crosses trust boundaries.
cargo install taudit taudit scan .github/workflows/ taudit map .github/workflows/quality.yml
One workflow. We map the authority path, identify what reached execution, and deliver an evidence pack your security, platform, and audit teams can use.
taudit is free and open source. The review is the paid step — £2,500 starter review.
Email opens pre-filled. Paste taudit output or describe the workflow — we'll take it from there.
This is the kind of output we care about: not only whether a secret exists, but which step, action, or identity can reach it across a pipeline boundary.
Workflow: .github/workflows/release.yml Authority graph: Steps: 16 | Secrets: 1 | Actions: 11 | Identities: 3 Critical: GITHUB_TOKEN propagated to actions/download-artifact@v4 across a trust boundary High: publish token has broad scope: packages: write, id-token: write Fix: reduce permissions or split the authority boundary
The workflow gives authority to a lower-trust step. Known: First-party build steps need release authority. Unexpected: Third-party or mutable steps can reach that authority. That is the gap.
"Even after applying what would traditionally be considered secure pipeline practices — separating workflows, reducing permissions, pinning actions — there were still non-obvious authority paths that only became visible once the workflow was modeled explicitly.
The biggest shift for me was realising CI/CD security isn't just about detecting vulnerable components — it's about understanding how authority propagates across trust boundaries."
Accepted into the NVIDIA Inception programme for AI startups.
Application submitted. Decision pending.
Open source. AGPL-3.0-or-later. Available on crates.io. GitHub Actions, Azure DevOps, GitLab CI.
Paid review service. One workflow scope. Evidence pack delivered.
Builds an authority graph from GitHub Actions workflow YAML.
Terminal output, JSON, SARIF, or CloudEvents JSONL.
GitHub Actions authority: secrets, identities, actions, and trust zones.
Run locally against a workflow file or directory. No signup.
The short version: scanning tells you what exists. Pipeline authority tells you how access can move. That is where trust gets real.
