In collaboration with
NASA and chipmakers prove their systems work correctly with formal verification. PreFlight applies it to AI agents: every action is checked against your rules before it runs, blocked if it breaks them, and backed by a receipt anyone can verify without seeing your rules or your data.
"An AI attesting to its own agent has the same problem as a firm auditing its own books, and a self-issued receipt gets discounted by any court or regulator that reads it."
Ken Priore, Deputy General Counsel, Docusign, writing in "The evidence layer is empty: notes from the NYU fiduciary AI workshop" (July 6, 2026). Quoted as independent commentary on the problem; not an endorsement of PreFlight or ICME Labs.
Built on formal methods and cryptography. Our work has been presented at the NY Fed's Innovation Conference, at a Google Cloud and Google DeepMind summit with a16z and Stanford, and at peer-reviewed cryptography venues. That research spans verifiable inference and post-quantum commitments.
The agents can already draft, file, pay, and negotiate. The ceiling is trust: nobody can enforce, and then prove, that an agent followed the rules on the work that matters.
PreFlight does not recognize attacks. It checks actions against your policy. Model error, hallucinated clause, prompt injection, drifting agent: all fail the same check. It blocks the action, whatever caused it.
The wrong action never runs, and the receipt proves it.
Your rules, in plain English. PreFlight compiles them to formal logic, checks them for contradictions, and tests them before they go live.
Before it acts, the agent states what it wants to do: pay this invoice, file this motion, send this reply.
PreFlight checks the action against your rules and either lets it run or blocks it. A rule decides, not a model, so the same action gets the same answer every time.
Every check produces a receipt. Anyone can verify it in under a second without seeing your rules or your data.
Every governance platform promises you can scale AI with confidence. Read the mechanism, and there is a human reading a dashboard inside it.
The agent runs at machine speed; the organization approves at the pace of inboxes. The gap between the two is work you cannot delegate.
The solver checks every action before it runs, at the speed the agent works, and the receipt proves it. Humans keep the two jobs that were always theirs: writing the rules, and judging the exceptions the rules route to them.
The volume of work you can govern stops being the volume a person can review.
PreFlight blocks the action, then hands you a receipt that leaves your trust boundary. A log is a statement your system makes about itself. The receipt is a statement the math makes about your system.
A log entryYour word for it |
A cryptographic receiptProof |
|
|---|---|---|
| Tamper resistance | –not edited or deleted after the fact | +tamper-evident: forging or editing it means breaking the cryptography |
| Policy | –the policy logged is the policy that ran | +against that exact policy |
| Input | –the input logged is the input that was checked | +on that exact input |
| Result | –the engine ran correctly rather than someone typing "deny" | +producing that exact result |
| Who can check it | –only someone willing to trust your systems | +verifiable by anyone in under a second, without trusting you or your systems |
| Privacy | –exposes the underlying policy and data to whoever audits it | +reveals nothing; your policy and your data stay private |
A rule decides, not a model. The gateway blocks before the action runs.
The receipt proves the rule was checked on that action, against that policy, with that result.
A third party checks the math themselves. No account, no access to your systems, and no sight of your policy or your data.
Intent is fixed as a checkable predicate at the root. Every downstream agent, from the orchestrator to each sub-agent, proves conformance. One broken link surfaces before any action lands.
A variant of IVC · Incremental Verifiable Computation✓ The predicate propagates untampered. Every upstream agent stays clean. Only the drifting node fails.
Actions are only half of what agents produce. Verbatim is the same discipline for the words. Every price, date, and policy claim compiles into a decoding grammar, so the model cannot generate a fact outside your spec.
Ask about itDeterministic by construction, not by prompt.
"The domestic wire fee is $35.00."
Every character traced to a policy span.