Meet the Only AI That Says No

(And how you can build your own.)

Today, there are two AIs running in my office. One is designed to say no.

The first, like probably a lot of you, is Claude Code, Anthropic’s terminal coding agent. Yes, yes, it’s a rented frontier brain. (In my defense, I’ve been tinkering with a lot of tools — and with Claude Code specifically — pointing it at different models and trying to understand it better. More on that later.) The other is a personal agent running Nous Research’s Hermes on local hardware. I call it Zora. (Time for my standard disclosure, the one you’ll hear every time Nous comes up: Mozilla, where I work, is an investor in Nous.)

In my architecture, Zora holds the keys. The Hermes agent has access to my calendar, my mail, and the accounts that matter. Claude Code — although it keeps asking me to authenticate MCP servers — holds none. I put a bridge between the two, so when Claude Code needs something, it asks Zora, one agent to another. And Zora gets to refuse.

This bridge is a form of diplomacy, requiring letters of introduction, credentials, protocol, a patrolled border. Look, I’m generally untrusting of software, and I want that mentality to propagate. I don’t want to hit Accept All. I want something standing in the way.

Advisory versus guaranteed

This past February, Meta’s director of alignment, Summer Yue, gave OpenClaw her inbox with one order: Confirm before acting. The context window filled, compaction deleted the order, and the agent started mass-deleting. She literally ran across her home to kill it at the machine, 200-plus emails gone. It was like defusing a bomb, she wrote.

Her order was a sentence, and the problem is that these systems are, by definition, stochastic. A model usually honors a sentence in a context window. (Usually.) A sentence steers; it doesn’t lock. Some instructions are advisory, some behavior must be guaranteed, and the two belong in different mechanisms. A hook is the guaranteed kind, a script the harness runs whether or not any context remembers to care.

So I wrote one. In my .claude, this script runs before every shell attempt:

“PreToolUse”: [{
  “matcher”: “Bash|Write|Edit|MultiEdit”,
  “hooks”: [{ “type”: “command”, “command”: 
“$HOME/.claude/hooks/guardrail.py” }]
}]

And guardrail.py inspects every command against rules that are data, not code:

- action: ask                     # deny | ask
  why: pushing publishes your work to a remote
  all: [’^git\s+(?:-C\s+\S+\s+)*push\b’]

A full list of all the commands to gate ships with the engine. Deny is a wall; it kills the catastrophic outright. Ask is a doorbell; commit, push, cron, anything acting unattended rings me first, even in bypass mode. Now I decide in code which commands need a human. Summer Yue had a polite sentence. But this is code that runs.

I put all of it up here. If you only skim, read CLAUDE.md, which holds behavior, not facts (the polite sentences). And for a fun time, check out agents/, where a whole subagent is one markdown file with a tools: allowlist; the README argues my case for keeping standing instructions under 200.

How to wire them together

Plenty of people got here before me, but I think agent-to-agent is an architecture, not a feature. Google shipped A2A. Cisco is drafting an Internet of Agents. IBM has a protocol, too. All of it is parking at the Linux Foundation. The academic version is from the 90s, when FIPA and KQML had software agents trading speech acts. I was there for it: At the MIT Media Lab, I was lucky to work with Nelson Minar on a system called Hive, distributed agents for networking things. Twenty-five years later, the agents caught up.

The connectors Claude keeps offering are MCP, the Model Context Protocol. But it’s polite sentences again, all of it running under one model’s judgment, one brain wearing every key. I wanted to experiment with more gates.

So instead of relying on MCP, today I have a bespoke bridge: an ask-zora skill in my .claude. The skill is a page of markdown that teaches Claude one move:

# what ask-zora teaches Claude to do, in one authenticated call:

curl --cert client.pem --key client.key --cacert my-ca.pem \
  -H “Authorization: Bearer $ZORA_TOKEN” \
  https://<zora-host>:8643/ask -d ‘{”question”: “what is on my thursday?”}’

A client certificate, a bearer token, an endpoint on my hardware. Claude sends a question over; Zora answers back. There are negotiations in my house now, in logs I own.

The Hermes agent decides what’s an appropriate ask. Claude asks for my work TODO list; Zora answers. Claude fishes for private email; Zora says no.

If you want to try, Hermes ships mcp serve, and you can point Claude at it:

# stand up your keyholder’s MCP surface, then point Claude Code at it:
claude mcp add zora --transport http http://<keyholder-host>:<port>
# everything Claude wants from your life now goes through that server that can say no.

The v0 bouncer isn’t new software, but it’s the keyholder deciding what it refuses.

What this isn’t, but could become: A2A, the open agent-to-agent protocol. My bridge is a private handshake between two parties who already know each other. A2A is for when strangers need to meet and collaborate. The agent card, a letter of introduction in JSON at a known address: who this agent is, what it discusses, how to prove yourself to it. And the protocol gives the conversation itself a grammar. Today, only Claude can ask Zora, because only Claude got the skill; speak A2A, and any compliant agent can knock. For now, bespoke is simpler, and I understand every byte. Maybe later, when the graph grows — when my agent is talking to yours.

The dividing line, perhaps, is state. Claude keeps what’s native to a coding agent — the repo, the build, the project on the bench. Zora keeps what’s personal, and the bridge could run both ways: Claude asks for what it needs, then files back what it learned (this shipped, that stalled, etc.). But the archive stays in the capital.

If the architecture holds, the bouncer is only the start; the keyholder becomes the context store, notes, history, the accumulated memory that makes an assistant mine. Claude doesn’t need to remember me. It asks the thing that does. Once deployment goes plural, what matters is the traffic between models and the context store everyone connects to. A2A’s backers tripled in year one; it sits beside MCP in the Linux Foundation. The gatekeeper seat, the agent that holds everything you are, is the last one a sane buyer wants to rent.

The problem with stochastic bouncers

You may not believe me. MCP wins on simplicity — one hop not two, a giant catalog, the right call for most people — while the bridge adds a hop, a second inference bill, new failure modes. The deeper problem? My bouncer is made of the same stuff as my intern. The containment is deterministic, keys can’t leave Zora’s host; that part is a lock. The discretion is stochastic; that part is a guard. A guard who refuses 99 times out of 100 isn’t a lock, it’s a bouncer with a price. A better permission boundary buys containment. Governance is a different animal.

My obsession right now is fewer stochastic things and more deterministic ones. Elevators used to come with an operator whose judgment carried you between floors. Safety came from the interlock, a mechanical fact keeping the doors shut in the shaft. No judgment, no mood, nothing to persuade. The interlock is a lock that needs no guard. Every agent today is an operator, brilliant and moody. So this only works because we are putting some harder guardrails in on the Zora side. Of my 136 scheduled jobs, 107 are deterministic scripts, no model in the loop, against 29 that think; interlocks winning four to one. What I want next is the big interlock: policy as code rather than policy as vibes. Governance is where this puck is heading; I’ll write it up soon.

Your Saturday project for this week

1. Run a local model on hardware you own.

2. Stand up its MCP surface (Hermes owners: hermes mcp serve).

3. Point Claude at it: claude mcp add.

4. Set approvals to manual; everything else asks.

Fork the repo, open guardrail_rules.yaml, write the three rules you never want optional. (You saw the shape.) You’ll have governance on your desk in no time: multple agents, and determinism. Do you have something in your stack that will say “no”?