Why OwnCharter governs at the gate
Most agent platforms are built wide open, then sandboxed and filtered after the fact. The agent can attempt anything; the platform tries to catch the bad attempts on the way out. When the filter misses, the postmortem begins.
OwnCharter inverts that. The agent is gate closed by default. It holds a whitelist of capabilities its owner granted, and every action passes a single chokepoint that checks the grant before execution. No grant, no action. There is nothing to catch on the way out because the unauthorized thing never ran.
That chokepoint fails closed. If the check cannot complete, the answer is no. And the agent cannot write to its own whitelist: authority only flows from the owner. What did run lands on a hash-chained record, so the audit trail is not a log file someone remembered to keep. It is a structural property.
Prevention, not detection. It is a small phrase with a large consequence: trust in the agent stops being a feeling and becomes something you can verify.