Let AI agents work without leaving them to define their own rules.

Why put an engine around the models?

Language models are useful for analysing a document, proposing a solution or writing code. They produce responses from learned patterns and the context they receive. A confident explanation therefore guarantees neither that a conclusion is correct nor that it applies to the present situation.

With a simple assistant, an error may remain a suggestion to review. An agent with tools can also change a file, transmit information or trigger an operation. Its permitted action, target and conditions must then be explicit. The quality of its explanation does not grant that permission.

How an error becomes harm

A fix that hides the vulnerability

An agent removes a security test to make a dashboard green. The application remains vulnerable. Verifying the repair requires repeating the unauthorised request, rather than just reading the report.

A document containing false instructions

A webpage tells the agent to send an internal archive to an external address. That text is data to analyse; it must not become permission to transmit the archive.

An action repeated after a lost response

A service does not respond after a request. The operation may already have happened. Repeating it without examining its state can create a duplicate, even when the previous account records no success.

These examples describe possible risks, not incidents claimed to have occurred in Swarm. OWASP describes excessive agency as a risk arising when overly broad functions, permissions or autonomy allow erroneous or manipulated output to cause harm.

What Swarm aims to provide

Swarm maintains an explicit work structure: a goal, requirements, a plan, tasks and dependencies. Agents produce analyses or candidates. Supervisors steer work and decisions within their scope. The engine checks the conditions of transitions it controls and retains the material needed to examine them.

This separation aims to prevent an agent from turning its own account into authorisation or evidence of success. A review concerns an identified candidate; a later change requires reassessing the relevant evidence. An anomaly should support an explained recovery while preserving history.

Memory helps retrieve context and lessons. It does not grant new permissions. Likewise, adding agents can distribute work but does not, by itself, make their result correct or their review independent.

Who is it for?

The project is intended for teams that want to delegate work to agents while keeping responsibilities, rules and verification criteria explicit. Software development is one application: scope a change, produce a candidate, run checks, organise its review and examine the result.

Business processes are a second intended use. They need their own permissions, connectors and operational evidence. A demonstration using a simulated scenario does not qualify a real payment or a critical deployment.