The last deterministic checkpoint before an AI agent acts.
Deterministic enforcement for AI agents
The last deterministic checkpoint before an AI agent acts.
Shield sits between AI agents and anything irreversible — payments, data, privileges, production systems. No model in the decision path.
Request a pilot→See how it works
Agents move fasterSafer together
- 202 automated tests
- Patent pending
- Runs offline
- Independently verifiable evidence
- No model in the decision path
- Same inputs, same answer, every time
- Reconfiguration is itself a gated action
- Enforcement fails closed; evidence fails open
- ### Deterministic Same inputs. Same policy. Same answer.
- ### Out of model No machine-learned model decides enforcement — there is nothing in the gate that reasons, so nothing that can be persuaded.
- ### Before execution The checkpoint exists before the irreversible action, not after it.
- ### Verifiable Decisions leave evidence an auditor, regulator, or court can check without believing us or you.
- ### When it acts TypicalAfter the action, or inside the model ShieldBefore execution
- ### How it decides TypicalInterpreted or probabilistic ShieldDeterministic — same inputs, same answer
- ### What you get TypicalAn alert ShieldAllow, require a human, or block
- ### What it leaves behind TypicalLogs you are asked to trust ShieldA hash-chained record anyone can verify
- ### Persuadable decision model TypicalPossible ShieldNone in the enforcement path
- Tamper-evidentEvery decision is hash-chained at the moment it's made.
- Anchored to trusted timeThe record carries when it happened, not when it was written up.
- Verifiable without trusting ShieldA standalone verifier imports nothing from Shield.
- 14 — Fourteen days
- Observe-only
- Deploys in about thirty minutes
- Nothing leaves your environment
- Free
- 01 202 automated tests Including tests that fail the build if honesty disclaimers are weakened.
- 02 Patent pending — USPTO, August 2026 Pending, not granted. Stated exactly that way everywhere.
- 03 Zero dependencies, runs offline Pure Python, standard library only. No SaaS component, no phone-home.
- 04 Independently verifiable evidence A standalone verifier that imports nothing from Shield.
- 05 SOC 2 / EU AI Act / NIST mapped reporting Framework mapping, not certification.
- Detection assumes an adversary that fears being caught01
- Asserted is not verified02
- There is a third detail: the agent wrote notes to its future self03
The problem
Intelligence is moving faster than control.
Different scales. Same missing layer.
1. 01 Summer 2026 An AI agent asked to book a gym class found a broken permissions check, deleted a stranger's reservation, and couldn't undo it. Irreversible. No undo existed. 2. 02 Summer 2026 The same month, three frontier labs disclosed that models inside a misconfigured evaluation harness reached real companies' systems — told they were isolated, they weren't. Isolation was asserted, not verified. 3. 03 Summer 2026 And one lab froze its own next model over cyber capabilities it could not rule out. The vendor's own control was to stop.
Detection assumes an adversary that fears being caught. An agent doesn't.
Monitoring told everyone what happened. Nothing made it not happen.
Without Shield
1. Agent 2. Action executes 3. Monitoring 4. Alert 5. Human investigates — after the fact
With Shield
1. Agent 2. Shield 3. Allow · Human · Block 4. Action proceeds or stops 5. Sealed evidence
How it works
A simple checkpoint. A safer world.
Every agent action is evaluated against bright-line rules before it reaches anything irreversible. Same inputs, same answer, every time.
1
Agent action
The agent proposes an action.
e.g. Book a flight to Tokyo and expense it.
Proceeds
→2
Shield
Evaluates the action against bright-line policy before execution.
→3
Decision
AllowProceeds within policy.Require a humanHeld for human sign-off.BlockStopped before execution.
→
4
Sealed evidence
Decision, policy result, timestamp and verification record — sealed at the moment it's made.
Decision sealed in a record anyone can verify.
Allow. Within policy — the booking proceeds.
Conceptual example — not live product output
Why Shield is different
Built around the failure modes that matter most.
Shield does not try to out-reason the agent. It sits outside the model and decides with rules that cannot be persuaded.
| Typical monitoring or model-centric control compared with Shield. A category comparison, not a claim about any specific product.| Aspect | Typical monitoring / model-centric control | Shield | | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | ---------------------------------------- | | When it acts | After the action, or inside the model | Before execution | | How it decides | Interpreted or probabilistic | Deterministic — same inputs, same answer | | What you get | An alert | Allow, require a human, or block | | What it leaves behind | Logs you are asked to trust | A hash-chained record anyone can verify | | Persuadable decision model | Possible | None in the enforcement path |
Typical monitoring or model-centric control compared with Shield. A category comparison, not a claim about any specific product.
Evidence
Evidence that doesn't need trust.
Every decision is hash-chained and anchored to trusted time at the moment it's made. A standalone verifier — which imports nothing from Shield — lets an auditor, regulator, or court confirm the record without believing us or you.
ActionDelete customer payment records
Policy resultOut of policy
DecisionBlock
Human sign-offNot required for this decision
TimestampAnchored to trusted time
RecordHash-chained at the moment of decision
VerificationCheckable by the standalone verifier
Illustrative example — not live product output
Start a pilot
See the difference in your environment.
Run Shield in observe-only mode for fourteen days.
See what would have been allowed, held for human review, or blocked — without changing a single outcome.
Shield deploys inside your environment in about thirty minutes — pure Python, no dependencies, fully offline-capable. In observe mode it structurally cannot block anything. Nothing leaves your environment. Not telemetry, not logs, not to us, not to anyone.
Request a pilot→See what the pilot produces
At the end of fourteen days you have
14
1. 01Exactly what enforcement would have done 2. 02What your agents did that a conservative policy would have held 3. 03Proposed rules — every one passes human review before it takes effect 4. 04A decision on whether to arm enforcement — a deliberate, staged step
Day 01Day 14
Proof
What can be checked.
Stated exactly, and only what can be checked.
Research / 01 — Red Horizon
6 min read
The industry is asking how the AI escaped. That's the wrong question.
Our read on the summer's agent incidents — and the questions worth asking instead.
Ideas → Safety → Real progress · Ideas → Safety → Real progress · Ideas → Safety → Real progress · Ideas → Safety → Real progress · Ideas → Safety → Real progress · Ideas → Safety → Real progress ·
A checkpoint in front of tomorrow
A safer agentic future is within reach.
Put a checkpoint between intelligence and irreversible action.