CAIN-42 CAIN StudioCAIN OpenShell, explained for beginners
OpenShell is the sandbox policy for an AI agent: every file, network or process action is checked first, and system secrets are refused.
What it is
Coding agents and other autonomous agents run commands and open files on real machines. OpenShell holds a policy per agent: which paths it may touch and what it may do.
Before the action, OpenShell answers ALLOW or DENIED with the reason and a digest of the decision. Protected system files such as /etc/shadow and private keys are refused. For commands it runs itself, it starts them with no new privileges, resource limits, a fresh environment and an unprivileged user.
An everyday comparison
A building pass that opens your office but not the server room, whoever you say you are.
How it works, in 4 steps
- The agent's policy is registered.
- Each file, network or process action is checked first.
- ALLOW or DENIED, with the reason.
- Every decision is written to the audit log.
Try it now
Open the three live demo tools → Every button sends a real request to the live product and shows the real answer.
See it on the homepage: CAIN OpenShell section →
Who it is for
Teams running coding agents or autonomous agents on real machines.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.