[ Agent Approval Surface ]
0xbox is your inbox for agentic actions on your phone.
An agent that can act can act wrongly — on an instruction it read in a file, a page, a tool result. 0xbox puts a human between the proposal and the action: the agent describes what it wants to do and on whose say-so, you approve or refuse on your phone, and the decision is signed into a record nobody can edit.
It never holds credentials, never executes, never sees the keys. Like a hardware wallet, it signs. The agent does the rest.
git push --force origin main
command text lifted from a file the agent readband: TOOL
rule: pushes must be typed, not read · confirmable
The signpost is rendered from the recorded provenance, not from anything the agent wrote. What you approve is what happened, not what the agent says happened.
An agent can't tell an order from a suggestion
01 / The Problem
Every consequential action an agent takes — send, push, pay, delete — was assembled from values it received. Some it was given. Some it found. It cannot reliably tell which, and neither can you, after the fact.
A gate can refuse the obvious cases. The interesting ones are the ones where the answer is "it depends" — and today that either becomes a wall the agent can't get past, or a prompt in a terminal nobody's watching.
0xbox is where "it depends" goes.
Three rungs
02 / How It Works
Act now
for actions the policy already permits. Logged, not asked.
Verify
a confirmable refusal reaches your phone with the rendered signpost. Approve with Face ID or refuse. The decision is signed with your key and the agent proceeds or stops.
Hand off
for actions that belong in the owning app. 0xbox deep-links you there with the context; the action completes where it should, and the record notes the handoff.
Approve is a signature, not a click. It's bound to the capability, the epoch and the exact arguments shown — so an approval can't be replayed against a different call.
A box is a trust boundary
03 / Boxes
One box per project, client or context. Each has its sources (which agents can propose), its tools (what they can propose), its limits (how much, how often), and its signers (who can approve).
Three boxes free. The fourth is where teams start.
| Sources | Tools | Limits | Signers | |
|---|---|---|---|---|
| Client work | claude-code, ops-runner | push, deploy, send | £500/day | you |
| Personal | claude-code | push | — | you |
| Ops | ops-runner, scheduler | send, transfer | £5k/week | you + colleague, 2-of-2 |
A log you can hand over
04 / The Record
Every proposal, every decision, who signed, what they were shown, and the chain hash — appended to the same tamper-evident record trust.band keeps. Approvals are attributed to a signer, not a session.
That record is what an insurer reads. See warrantable.org.
Where it stands
05 / Status
Built
the policy, provenance and signing layer underneath (trust.band 0.7.2, PyPI); the Claude Code hook that produces confirmable refusals.
Working, rough
Telegram approval with inline buttons, single signer, single rung. Running on the founder’s own agents.
Not built
the iOS app, Face ID, hand-off, multi-signer. This is what the first hundred are for.
Free for the agents you run for yourself
06 / Pricing
Free
£0
1 user, 3 boxes, single signer. Telegram approvals. Full record.
Pro
£29/ month
Unlimited boxes. iOS app when it ships. Approvals routed to a colleague or client. Retained record.
Pro+
£49/ month
Everything in Pro. n-of-m signers per box. Per-box limits and reports.
Enterprise
from £2,500/ month
Bring your own key. Per-tenant separation. Compliance mapping.
Replaces the trust.band Unattended add-on. If you have that, you have 0xbox Free.
Stated plainly
07 / What This Does Not Do
It doesn’t decide for you
0xbox routes the question. The policy that decides what’s confirmable is yours, in trust.band.
It doesn’t hold anything
No credentials, no tokens, no execution. A stolen phone can approve; it can’t act.
The phone is not yet in your pocket
Telegram today. iOS is the product; it isn’t shipped. The page says so because the record does.
The First Hundred
One box, your own agents, Telegram approvals
Direct access to the person building it. In return: what you approved, what you refused, and what the signpost got wrong.
ApplyOne surface of four
08 / Where It Sits
isovert
Cryptographic tenant isolation for confidential AI serving. isovert.com
NablaDB
Confidential multi-tenant vector retrieval. nabladb.com
Deletable
Per-subject cryptographic erasure for Article 17. deletable.org
0xbox
The approval surface. Agents propose, you sign. On trust.band.