Five letters that keep autonomous agents accountable.
A company-standard governance layer from Spin State Labs. Where FORCE constrains what an AI says, FIELD constrains how an AI is deployed, owned, and audited.
FORCE keeps individual AI responses defensible. But once an autonomous agent is out in the world - pulling data, sending messages, taking irreversible actions - you have a class of problems that no amount of prompt engineering will solve. FIELD is the governance layer for exactly those problems.
What stops an autonomous agent when it goes wrong? Kill switches, action boundaries, escalation triggers, spend caps. The brakes and rails of agentic operation.
Who owns this agent? Whose interests does it represent? In what jurisdiction does it operate? What authority has been delegated, and by whom?
When agents from different organizations must interoperate, what trust protocols govern the boundary? What data crosses; what stays sovereign?
FIELD is a governance manifest that ships with every autonomous agent Spin State Labs deploys. YAML, versioned, cryptographically sealed audit trail. Each of the five letters constrains one dimension of agent deployment.
Agents from different organizations must interoperate without leaking authority. The Federated section declares which peers this agent may talk to, on what trust basis, and under which contracts. "Isolated, no peers" is a valid answer, but it has to be declared.
Every autonomous agent represents a principal. Identity nails down attribution: who owns this agent, whose interests it serves, what jurisdiction governs its operation, what data scope it is authorized to touch.
Autonomous agents need brakes and rails. Enforcement declares the kill switch, spend cap, escalation triggers that pause for human review, and the policy for irreversible actions. As of v1.2, the Claude Code Enforcement Gate enforces the kill switch, protected paths, irreversible-action deny patterns, a per-session tool-call budget and opt-in session-written execution checks at runtime.
If it isn't logged, it didn't happen. Ledger declares a cryptographically sealed audit trail with retention in days; a manifest with sealing turned off does not validate. In Claude Code, the v1.2 gate appends every allow and deny to a sha-256 hash chain that /field verify checks. File-tool records carry the write path: root-relative inside the project, sha256 outside it. Tamper-evident, not tamper-proof: anyone with write access can rewrite it.
Autonomous agents act on behalf of humans. Delegation makes the authorization chain explicit: what this agent has been authorized to do, by whom, within what scope, and when that authority expires. Without a clear delegation chain, there is no sovereignty.
FIELD 1.2 ships an Enforcement Gate: a Claude Code PreToolUse hook that reads ./field-manifest.yaml before every gated tool call (every tool except Read, Glob, Grep, LS, NotebookRead and TodoWrite, including PowerShell and MCP tools) and denies what the manifest forbids. In 1.1 only Bash, Edit, Write, MultiEdit and NotebookEdit were gated. E1, E2, E4 and L apply to all gated tools; E3 and E5 apply to Bash and PowerShell only. It fails closed: an unreadable manifest, missing PyYAML or an internal error denies the call (rule E0). Without a manifest the hook does nothing.
.claude/settings*.json, hooks.json or the ledgersession_written_exec: deny, a Bash or PowerShell command that names a file this session wrote with a file tool is deniedeval and files created by Bash itself get throughpython3 and PyYAML; if python3 does not resolve, nothing is enforced/field audit produces an audit-ready report, not a certification/field kill # trip the kill switch (create the sentinel file) /field resume # show how a human lifts the kill switch; confirm when lifted /field verify # check the ledger hash chain (tamper-evident)
Three layers, one contract: the manifest declares the five answers; the gate enforces part of it inside Claude Code; the reference platform (github.com/SpinStateLabs/field-platform, public) implements governance services an agent calls before it acts. The platform is cooperative: an agent has to ask.
The one-pager and Claude Code plugin install are free with no friction. The framework document and manifest templates ship via email so we can send updates as the framework evolves.
# Add the marketplace /plugin marketplace add SpinStateLabs/Force-Field # Install FIELD /plugin install field@force-field # Verify /field
Full reference. Every letter, every manifest field, examples.
→ Get via email/field slash command with init, validate, assess, audit, export, plus kill, resume, verify and the v1.2 Enforcement Gate hook.
Default, financial-agent, read-only-agent, client-facing-agent.
→ Get via emailWe'll email you the FIELD framework doc, the JSON manifest schema, and all four manifest templates. One message. No drip campaigns unless you opt in below.
Governance is a crowded category. FIELD is not trying to compete with NIST AI RMF, ISO 42001, or the EU AI Act. It's the layer beneath them - the artifact that travels with each individual agent.
/field audit produces an audit-ready reportFIELD is one piece of how Spin State ships defensible agentic AI into enterprise financial planning. If you're deploying autonomous agents into audit-adjacent work and you want the governance discipline we apply to every client engagement - let's talk.
Start a conversation →