Synsema is a language where permission is syntax. The platform runs your agent under exactly what it declared, seals its secrets, and keeps the audit your security team will ask for.
Deploy your first agent See the API
Free for one service. Bring your own LLM key. The language is open source.
What runs here
Sites, APIs, server-rendered pages. One process serves HTML to people and Markdown to agents.
Expose tools to Claude, Cursor or any client. One route, secrets sealed, input under a ceiling.
No URL. Watch feeds, queues, chains, inboxes. Always on, under the same ceiling.
Blackboard, signals, spawn. Many agents in one process, one manifest for all of them.
EVM, Solana, Bitcoin, Algorand. Signing and spending are capabilities, metered and audited.
A PWA with native push, or a desktop binary. Same program, same fence.
Before it runs
Every deploy intersects what the code declares with require and what your plan permits. The result is a table, not a policy: this line granted, this line denied, and why. The program can never rise above it, because the runtime enforces the ceiling on every call.
| Declared in the program | Scope | On the Free plan |
|---|---|---|
| require net("rpc.arc.network") | rpc.arc.network | granted |
| require llm | — | granted |
| require secret("ARC_HOT_KEY") | ARC_HOT_KEY | granted |
| require sign("ARC_HOT_KEY") | ARC_HOT_KEY | denied · above the plan |
| require spend("USDC") | USDC | denied · above the plan |
| require memory("invoice-agent") | invoice-agent | granted |
While it runs
Every capability check the runtime performs, granted or denied, is written down with its origin and its reason. When an agent tries to read the cloud metadata address it never declared, the line is there, in red, with the refusal. That is the page a CISO opens first, and the one that closes the deal.
| 14:02:11 | sign | ARC_HOT_KEY | granted | invoice #2291 · 412 USDC |
| 14:02:10 | spend | USDC | granted | 412 / 500 |
| 13:58:40 | net | 169.254.169.254 | denied | never declared |
| 13:58:39 | llm | — | granted | reason · 1,930 tokens |
| 13:58:38 | secret | ARC_HOT_KEY | granted | sealed · never printed |
What it never sees
A secret() is opaque to the program that holds it. It authenticates, signs and pays, but it cannot be printed, logged, serialized or handed to a model. Prompt injection has nothing to steal, and your security review has one less question.
require secret("ARC_HOT_KEY") require sign("ARC_HOT_KEY") let key be secret("ARC_HOT_KEY") print(key) -- what the model would love to see let sig be secp256k1_sign(digest, key) -- what it is allowed to do
Built to be delegated
The whole permission surface is a block at the top of the file. Reviewed in a pull request, diffed between versions, readable by an auditor in twenty lines.
A runner is a machine with Docker and one program. It only calls out to the control plane, so putting it in your tenant gives us access to nothing of yours.
Enterprise services sit behind your SSO from the first deploy, with roles per project and an audit that goes to your SIEM. The confidential tier, in a TEE, is next.
Recipes
web · web.syn
The open-source coding agent, hosted. Your own Lampson at a URL, with a workspace of its own.
web · web.syn
A dark pool for block trades on Horizen's Vela, in Synsema: orders go in encrypted, the enclave matches them, settlement comes from escrow; nobody sees the book, and losing orders are never revealed.
web · web.syn
A payment policy engine on Horizen's Vela, in Synsema: an AI agent reviews invoices and proposes payments, the enclave enforces the spending policy (allowed payees, caps, an automatic limit, approvals) and a contract pays. The agent never holds a key.
web · web.syn
Private payroll on Horizen's Vela, in Synsema: an employer pays a list of people in a stablecoin; nobody outside sees who earns what, each person sees only their payslips, and an auditor gets the report.
web · web.syn
Private transfers on Horizen's Vela, in Synsema: balances and transfers stay encrypted in the enclave, each transfer carries an invoice and leaves one public receipt; the starter kit for any Vela app, with the guest, its tests and a workbench.
From the blog
For some workloads the interesting question is not which model is best, but whether the data is allowed to leave at all. A model inside the process answers that with no egress, no vendor in the trust chain and no bill per token — and the price it charges is in latency and model size.
The calibrated probability that decides what a person sees no longer has to come from an API. An open-source System One checkpoint on your own disk answers the same typed questions with no key, no network and no cost per token — and the same program runs against either one.
Routing, tagging, eligibility and moderation are the highest-volume AI work most products do, and the cheapest to get wrong. A System One model answers them with a calibrated probability — and the economics are not close.
One command, a URL, and a record of everything the program was allowed to touch. Start free, bring your own key.