Ambit · open protocol · working draft
Ambit: a common language for agent actions.
Ambit is an open protocol for describing what an AI agent's action may do, who may authorize it, within what bounds it runs and what proof remains. Ond convenes it in the open. OSuite is its reference implementation.
The problem
The same action arrives in many shapes.
An agent can deploy code, issue a refund or export data through a shell command, an MCP tool call, an SDK or an API request. To the organization, these can be the same business action.
If every runtime brings its own way to describe actions, ask for approval and record evidence, each organization rebuilds governance for each runtime, and evidence from one system cannot be checked in another.
A common representation of the action itself would let governance stay independent of any one model, framework or vendor. Ambit is our attempt at that representation, published so others can test it, improve it or show where it fails.
Where it fits
Alongside the protocols agents already use.
Ambit does not replace them. It describes and governs the action itself as it crosses them.
MCP
Connects agents to tools and data.
A2A
Connects agents to other agents.
IAM
Establishes who a person or workload is.
Ambit
Describes what an action may do, under whose authority, within what bounds, and what proof remains.
The layers
What Ambit defines, and how far each part has come.
One layer is a published draft today. The others come from Ond's research and already run in OSuite, but are not yet public specifications.
-
01
Action
One canonical identity for an action, whether it arrives as a shell command, a tool call, an SDK call or an API request.
Research · runs in OSuite -
02
Effects
What the action may do, the evidence for that description and what is still unknown, kept separate from permission to execute.
Action Effect Spec 0.2 draft: 28 core requirements, two separately written consumers
Published draft -
03
Authority
Who holds final authority over the action, and how an approval binds to the exact action that runs.
Research · runs in OSuite -
04
Bounds
A lease that limits what an approval allows: the action, actor, session, destination, policy version and time window.
Research · runs in OSuite -
05
Evidence
Signed receipts that survive replay and audit. Rules for which evidence can be reused when the environment changes are still research.
Receipts in OSuite; reuse rules in Matoi
Research · runs in OSuite
-
Fast path
Approve ahead of dispatch, then check at the boundary.
Research -
Conformance
Frozen cases, separate expected-result checks and raw reports. Runs offline, with no OSuite server or account.
Action Effect Bench 0.4 draft
Published draft
"Runs in OSuite" means the reference implementation uses it; it is not yet a public specification. Research papers are arXiv preprints and have not been peer reviewed.
The principle
The protocol should not depend on OSuite. OSuite should depend on the protocol.
Why OSuite exists
OSuite came second, to make Ambit practical.
Lower the barrier
Teams can use the protocol today, across Claude, ChatGPT, Codex, Cursor, n8n and Dify, without building it themselves.
Reproducible research
A running system gives our research a place to run experiments that others can repeat.
Real conditions
Real runtimes test whether the design holds up beyond the paper.
Feedback
What breaks in OSuite becomes a change to the protocol, not a private workaround.
Take part
Implement it, test it, or prove it wrong.
Implement it
Emit and check effect descriptions in your own agent runtime.
Read the spec ↗Challenge it
Open an issue where the specification is wrong, vague or too narrow.
Open an issue ↗Test it
Run the benchmark offline against your implementation.
Bench quickstart ↗Build without us
An independent implementation that never touches OSuite is the strongest test of all.
Governance proposal ↗