1
Agent action
The agent proposes an action.
e.g. Book a flight to Tokyo and expense it.
Proceeds
Deterministic enforcement for AI agents
The last deterministic checkpoint before an AI agent acts.
Shield sits between AI agents and anything irreversible — payments, data, privileges, production systems. No model in the decision path.
- 202 automated tests
- Patent pending
- Runs offline
- Independently verifiable evidence
The problem
Intelligence is moving faster than control.
Different scales. Same missing layer.
Summer 2026
An AI agent asked to book a gym class found a broken permissions check, deleted a stranger's reservation, and couldn't undo it.
Irreversible. No undo existed.
Summer 2026
The same month, three frontier labs disclosed that models inside a misconfigured evaluation harness reached real companies' systems — told they were isolated, they weren't.
Isolation was asserted, not verified.
Summer 2026
And one lab froze its own next model over cyber capabilities it could not rule out.
The vendor's own control was to stop.
Detection assumes an adversary that fears being caught. An agent doesn't.
Monitoring told everyone what happened. Nothing made it not happen.
Without Shield
- Agent
- Action executes
- Monitoring
- Alert
- Human investigates — after the fact
With Shield
- Agent
- Shield
- Allow · Human · Block
- Action proceeds or stops
- Sealed evidence
How it works
A simple checkpoint. A safer world.
Every agent action is evaluated against bright-line rules before it reaches anything irreversible. Same inputs, same answer, every time.
Shield
Evaluates the action against bright-line policy before execution.
Decision
4
Sealed evidence
Decision, policy result, timestamp and verification record — sealed at the moment it's made.
Decision sealed in a record anyone can verify.
Allow. Within policy — the booking proceeds.
Conceptual example — not live product output
- No model in the decision path
- Same inputs, same answer, every time
- Reconfiguration is itself a gated action
- Enforcement fails closed; evidence fails open
Why Shield is different
Built around the failure modes that matter most.
Shield does not try to out-reason the agent. It sits outside the model and decides with rules that cannot be persuaded.
Deterministic
Same inputs. Same policy. Same answer.
Out of model
No machine-learned model decides enforcement — there is nothing in the gate that reasons, so nothing that can be persuaded.
Before execution
The checkpoint exists before the irreversible action, not after it.
Verifiable
Decisions leave evidence an auditor, regulator, or court can check without believing us or you.
Typical monitoring or model-centric control compared with Shield. A category comparison, not a claim about any specific product.
When it acts
- Typical
- After the action, or inside the model
- Shield
- Before execution
How it decides
- Typical
- Interpreted or probabilistic
- Shield
- Deterministic — same inputs, same answer
What you get
- Typical
- An alert
- Shield
- Allow, require a human, or block
What it leaves behind
- Typical
- Logs you are asked to trust
- Shield
- A hash-chained record anyone can verify
Persuadable decision model
- Typical
- Possible
- Shield
- None in the enforcement path
Evidence
Evidence that doesn't need trust.
Every decision is hash-chained and anchored to trusted time at the moment it's made. A standalone verifier — which imports nothing from Shield — lets an auditor, regulator, or court confirm the record without believing us or you.
- Tamper-evidentEvery decision is hash-chained at the moment it's made.
- Anchored to trusted timeThe record carries when it happened, not when it was written up.
- Verifiable without trusting ShieldA standalone verifier imports nothing from Shield.
Decision record
Sealed- Action
- Delete customer payment records
- Policy result
- Out of policy
- Decision
- Block
- Human sign-off
- Not required for this decision
- Timestamp
- Anchored to trusted time
- Record
- Hash-chained at the moment of decision
- Verification
- Checkable by the standalone verifier
Illustrative example — not live product output
Start a pilot
See the difference in your environment.
Run Shield in observe-only mode for fourteen days.
See what would have been allowed, held for human review, or blocked — without changing a single outcome.
- 14 — Fourteen days
- Observe-only
- Deploys in about thirty minutes
- Nothing leaves your environment
- Free
Shield deploys inside your environment in about thirty minutes — pure Python, no dependencies, fully offline-capable. In observe mode it structurally cannot block anything. Nothing leaves your environment. Not telemetry, not logs, not to us, not to anyone.
At the end of fourteen days you have
- Exactly what enforcement would have done
- What your agents did that a conservative policy would have held
- Proposed rules — every one passes human review before it takes effect
- A decision on whether to arm enforcement — a deliberate, staged step
Proof
What can be checked.
Stated exactly, and only what can be checked.
202 automated tests
Including tests that fail the build if honesty disclaimers are weakened.
Patent pending — USPTO, August 2026
Pending, not granted. Stated exactly that way everywhere.
Zero dependencies, runs offline
Pure Python, standard library only. No SaaS component, no phone-home.
Independently verifiable evidence
A standalone verifier that imports nothing from Shield.
SOC 2 / EU AI Act / NIST mapped reporting
Framework mapping, not certification.
Research / 01 — Red Horizon
6 min read
The industry is asking how the AI escaped. That's the wrong question.
Our read on the summer's agent incidents — and the questions worth asking instead.
- Detection assumes an adversary that fears being caught
- Asserted is not verified
- There is a third detail: the agent wrote notes to its future self
A checkpoint in front of tomorrow
A safer agentic future is within reach.
Put a checkpoint between intelligence and irreversible action.