Platform
Synsema is a language where permission is syntax. The platform runs your agent under exactly what it declared, seals its secrets, and keeps the audit your security team will ask for.
What runs here
Sites, APIs, server-rendered pages. One process serves HTML to people and Markdown to agents.
Expose tools to Claude, Cursor or any client. One route, secrets sealed, input under a ceiling.
No URL. Watch feeds, queues, chains, inboxes. Always on, under the same ceiling.
Blackboard, signals, spawn. Many agents in one process, one manifest for all of them.
EVM, Solana, Bitcoin, Algorand. Signing and spending are capabilities, metered and audited.
A PWA with native push, or a desktop binary. Same program, same fence.
Before it runs
Every deploy intersects what the code declares with require and what your plan permits. The result is a table, not a policy: this line granted, this line denied, and why. The program can never rise above it, because the runtime enforces the ceiling on every call.
| Declared in the program | Scope | On the Free plan |
|---|---|---|
| require net("rpc.arc.network") | rpc.arc.network | granted |
| require llm | — | granted |
| require secret("ARC_HOT_KEY") | ARC_HOT_KEY | granted |
| require sign("ARC_HOT_KEY") | ARC_HOT_KEY | denied · above the plan |
| require spend("USDC") | USDC | denied · above the plan |
| require memory("invoice-agent") | invoice-agent | granted |
While it runs
Every capability check the runtime performs, granted or denied, is written down with its origin and its reason. When an agent tries to read the cloud metadata address it never declared, the line is there, in red, with the refusal. That is the page a CISO opens first, and the one that closes the deal.
| 14:02:11 | sign | ARC_HOT_KEY | granted | invoice #2291 · 412 USDC |
| 14:02:10 | spend | USDC | granted | 412 / 500 |
| 13:58:40 | net | 169.254.169.254 | denied | never declared |
| 13:58:39 | llm | — | granted | reason · 1,930 tokens |
| 13:58:38 | secret | ARC_HOT_KEY | granted | sealed · never printed |
What it never sees
A secret() is opaque to the program that holds it. It authenticates, signs and pays, but it cannot be printed, logged, serialized or handed to a model. Prompt injection has nothing to steal, and your security review has one less question.
require secret("ARC_HOT_KEY") require sign("ARC_HOT_KEY") let key be secret("ARC_HOT_KEY") print(key) -- what the model would love to see let sig be secp256k1_sign(digest, key) -- what it is allowed to do
Beyond the container
The platform runs any Synsema program, so what the language does comes with it. Each of these is documented and was verified against the real system; the tag says where it stands today.
A program asks the hardware for a document that binds its code to its answer — AWS Nitro, Intel TDX, AMD SEV-SNP, dstack — and a client checks it with attestation_verify before sending data in. Data labelled private is refused by every public sink.
require attest let doc be attest({"report_data": digest})
A .syn file runs as an app of Horizen's confidential coprocessor: inside a Nitro enclave, with its state encrypted and every result settled on-chain as a signed state root. Four open kits to start from:
Ethereum and any EVM chain, Avalanche, Solana, Algorand and Bitcoin. The key is sealed as a secret; signing and spending are capabilities the plan meters and the audit records. Agents can register on Synsema Network, a public registry of agents.
require sign("HOT_KEY") require spend("USDC")
judge asks a System One model typed questions — whether, choose, rate — and gets back probabilities your code can gate on, not text. TypeSafe's Jev is the first backend; since v0.6.27 an open-source checkpoint (Laya, Apache 2.0) answers the same questions with no key and no network.
require judge let v be judge ticket refund: whether "Asks for money back"
Built to be delegated
The whole permission surface is a block at the top of the file. Reviewed in a pull request, diffed between versions, readable by an auditor in twenty lines.
A runner is a machine with Docker and one program. It only calls out to the control plane, so putting it in your tenant gives us access to nothing of yours.
Enterprise services sit behind your SSO from the first deploy, with roles per project and an audit that goes to your SIEM. The confidential tier, in a TEE, is next.
Recipes
web · web.syn
The open-source coding agent, hosted. Your own Lampson at a URL, with a workspace of its own.
web · web.syn
A dark pool for block trades on Horizen's Vela, in Synsema: orders go in encrypted, the enclave matches them, settlement comes from escrow; nobody sees the book, and losing orders are never revealed.
web · web.syn
A payment policy engine on Horizen's Vela, in Synsema: an AI agent reviews invoices and proposes payments, the enclave enforces the spending policy (allowed payees, caps, an automatic limit, approvals) and a contract pays. The agent never holds a key.
web · web.syn
Private payroll on Horizen's Vela, in Synsema: an employer pays a list of people in a stablecoin; nobody outside sees who earns what, each person sees only their payslips, and an auditor gets the report.
web · web.syn
Private transfers on Horizen's Vela, in Synsema: balances and transfers stay encrypted in the enclave, each transfer carries an invoice and leaves one public receipt; the starter kit for any Vela app, with the guest, its tests and a workbench.
From the blog
The judge slot is a protocol, not a vendor. Since v0.6.27 a Laya checkpoint on disk — ModernBERT, Apache 2.0 — answers whether, choose and rate with no network, no secret and no cost per token, and the same block runs unchanged.
Since v0.6.27 the embedded local provider takes the name of a model already in your Ollama or Hugging Face cache — nothing is downloaded — and an architecture is a text file the compiled binary reads, so adding a model no longer waits for a release of ours.
For some workloads the interesting question is not which model is best, but whether the data is allowed to leave at all. A model inside the process answers that with no egress, no vendor in the trust chain and no bill per token — and the price it charges is in latency and model size.
One command, a URL, and a record of everything the program was allowed to touch. Start free, bring your own key.