membrane · agent state + governance layer

What Your Agent Believes — and Whether It's Still True.

membrane is the state and governance layer for AI agents, built on fasten. It computes what the agent believes, why, whether it's still true, and what to do about it — before a bad action lands.

The wider AI agent governance category is converging on the right shape (discover, enforce, prove); where products differ is the substrate underneath — a vendor sensor in your network, or the audit log your services already write. membrane runs in your code path, not your network.

Get StartedS Read the DocsD

membrane explain

$ membrane explain usr_42 plan = "Growth" src=billing ✓ fresh tier = "enterprise" src=crm ⚠ 40d old region = "EU" src=session ✓ fresh # belief assembled from 3 sources · per-field provenance

audit → belief & governance → correction

three layers above your agent framework — one substrate underneath

A Layer Your Framework Leaves to You

Below Orchestration

Frameworks Make It Run

LangGraph, CrewAI, AutoGen, and Letta orchestrate the agent. They ship state schemas, reducers, and checkpointers — then hand the state architecture back to you.

Above Call-Tracing

Tracing Sees One Call

Per-call LLM tracing tools show what was sent to the model on a single call — per call, in process, mutable. They don't model belief over time or reconcile against your systems of record.

membrane · The Seam

membrane Makes It Correct

The seam between them: belief over time, drift reconciliation against the source of record, policy enforcement, and a tamper-evident trail. The thing only membrane does.

The Base Layer

membrane is built on the fasten substrate — one typed, correlated, tamper-evident event model. Framework-agnostic by design, because state is where LangGraph, CrewAI, AutoGen, Letta, and homegrown agents all leave you on your own.

How It Works · The Pipeline

01→

Belief

membrane · belief engine

Per-field provenance — which source won, when it was last verified, and freshness or TTL on every value the agent holds.

02→

Drift

membrane · drift

Reconcile the belief against your systems of record. When the agent's copy diverges from the source, surface the drift.

Control

membrane · control tier

Decide and enforce on the request path — block the action on stale or contradicted state before the side-effect lands.

↳ mbnl sits in front of all three — the model boundary normalization layer maps any model or vendor's output to one typed event before it touches state, and raw output enters at the lowest authority so it can't corrupt the belief. control is membrane's enforcement tier, not a separate product.

membrane · Drift Reconciliation

Stop the Agent Acting on State That's Already Wrong.

An agent holds plan = Growth, active. Billing cancelled the customer three days ago — a missed webhook, or a value cached at session start. membrane reconciles the belief against Stripe, the system of record, and the control tier blocks the refund before it goes out.

Per-field provenance — which source won, and when it was last verified.
TTL and decay — "verified 40 days ago, low confidence" instead of a confident wrong answer.
A tamper-evident trail — the drift event recorded by fasten for the auditor.

See the Use CasesR

membrane explain

$ membrane explain usr_42 plan # belief plan = "Growth" // cached source = session_start verified_at = "40d ago" confidence=low # reconcile → Stripe (system of record) stripe.plan = "cancelled" ⚠ DRIFT belief ≠ source_of_record action = blocked (refund)

mbnl · normalize

# any model, any vendor → one typed event openai → {tool_call, args:{...}} ┐ claude → {tool_use, input:{...}} ├─► mbnl vendor → {function, params:{...}} ┘ # one typed event, lowest authority event.kind = "llm_inference" event.source = "model_output" authority = "proposed" // not belief yet

mbnl · The Front Layer

A Model Swap Becomes a Config Change.

You switch GPT to Claude for cost or quality. The tool-call and state shapes differ, and state extraction quietly corrupts. mbnl — the model boundary normalization layer in front of membrane — maps every vendor's output to one typed event before it touches state.

Raw model output enters at the lowest authority — it proposes, it never asserts belief at full trust.
Swapping models updates the boundary mapper — the graphs stay untouched.
One typed event flows into fasten, correlated and tamper-evident.

Read the Docs→

Use Cases · Illustrative Failure Classes

Where Agent State Goes Wrong.

The same failures happen on any framework, because state is what every framework leaves to you. These are illustrative problem → solution scenarios, not customer case studies.

Drift · Stripe

The Refund to a Customer Who Already Churned

An agent holds plan = Growth, active; Stripe cancelled them three days ago. The agent issues a refund and re-grants access. membrane reconciles against the system of record, and the control tier blocks the action until it is re-verified.

Coherence · Cross-Thread

Two Conversations, Two Answers

Same user, two threads — web chat and email. Each holds its own plan tier and preferred tone; they diverge; the agent contradicts itself across channels. membrane declares fields user-global or thread-local, surfaces the contradiction, and resolves to the authoritative source.

Freshness · TTL

The Stale Quote You Get Held To

A sales or support agent cached a price, policy, or eligibility rule. It changed. The agent quotes the old value confidently. Per-field TTL and decay mean the agent sees "verified 40 days ago, low confidence" and hedges or refreshes instead of asserting.

Provenance · explain

"Why Did It Say That?" — and You Can't Answer

An agent gave a wrong answer; compliance wants the exact reconstruction. Tracing shows spans, not the belief state or provenance. fasten's 7-anchor trail plus membrane explain shows this value, this source won, this was suppressed, verified at T.