Anchor

Anchor exists because policy expressed only in prose cannot govern autonomous systems reliably. The system turns governance into executable infrastructure so runtime behavior can be inspected, replayed, and reviewed.

By checking codebases against formal compliance parameters using AST matching rather than probabilistic reviews, Anchor guarantees absolute determinism in policy outcomes.

• AI systems make opaque, probabilistic decisions that are difficult to audit or enforce.
• Standard regex-based scanning creates high volumes of false positives in dependency code.
• Post-hoc logging fails to provide cryptographically checkable evidence of compliance.

I built Anchor after noticing that teams deploying LLMs were repeatedly solving compliance in an ad hoc, probabilistic way.

The core motivation was to bring the rigor of compiler design and formal static analysis to the runtime behavior of AI agents.

Anchor parses codebases into abstract syntax trees (ASTs) using Tree-sitter, evaluating declarative rules defined in .anchor files.

Decisions are logged to a tamper-evident audit file with Ed25519 signatures, enabling cryptographic validation of decision history.

The core scan loop is written in Python, operating in two modes: AST node query matching (Mode A) and regex fallback (Mode B).

It compiles and runs as a CLI command line utility (anchor check) and packages policy intents separately from detection matches.

We decoupled rule definitions (policy intent) from detection scripts to allow policy authors and parser developers to work independently.

We selected AST parsing over standard regex matching for the primary check to eliminate false positives in downstream code.