Provable SECURITY for AI agents

Tell your AI what to do.
Get proof it did exactly that.

Every other AI guardrail asks you to trust it: that it ran, that it wasn't bypassed, that the operator's word is good. PreFlight checks every agent action against your rules before it runs, blocks the ones that break them, and turns that trust into a receipt anyone can verify.

Get your first proof Book a call

Try it risk free today | no credit card required | MCP enabled.

Built on the security foundations of cryptography and formal methods.  Verifiable inference "Jolt Atlas: Verifiable Inference via Lookup Arguments in Zero Knowledge" · peer-reviewed · zkSummit 2026 Post-quantum commitments "ABBA: Lattice-Based Commitments from Commutators" · peer-reviewed · PQ Crypto 2026 Technology leadership Federal Reserve Bank of New York, 2026 Innovation Conference · Zero Knowledge Podcast for cryptography innovators
Trusted by AWS Arrington Capital Avistar.AI Finality Rule 26 AI Venice AI
The real bottleneck

Agents are stuck on low-stakes work. The missing piece is proof, not capability.

The agents can already draft, file, pay, and negotiate. The ceiling is trust: nobody can enforce, and then prove, that an agent followed the rules on the work that matters.

  • ✗Legal, risk, and audit will not sign off on an agent they cannot verify, so the pilot never reaches production.
  • ✗Logs say a rule fired. A log is a claim your own system makes about itself, and auditing it takes weeks.
  • ✗Reactive guardrails tell you what went wrong after it already moved money or data.
  • ✗An AI that grades another AI is built from the same kind of model it is meant to check, so anything that fools the agent can fool the grader.
The meeting where agents stall

"What proves the rule fired, not just that it was logged?"

"How does review keep up with the agent?"

"Who can verify that without trusting us?"

Pilot: on hold.

The agent was never the problem. The unanswerable questions were. The rest of this page answers them.

Enforcement

Block rule-violating agent actions.

PreFlight is not a watcher. The block is cause-agnostic: a model error, a hallucinated clause, a prompt injection, or a drifting background agent all get stopped the same way. PreFlight does not need to recognize the attack; it blocks the action the attack was for.

The agent tries a wire over the approval limit
✗ UNSAT · BLOCKED
The money never moves.
The agent files without a required review
✗ UNSAT · BLOCKED
The filing never reaches the court.
The agent sends data that must not leave
✗ UNSAT · BLOCKED
The message never sends.

The wrong action never runs, and the receipt proves it.

How PreFlight works

Your rules become binding on agent actions.

01

Agent proposes an action

The agent states what it wants to do, in the action text itself: amount, recipient, scope.

02

Rules compile to formal logic

Your plain-English policy is translated to formal logic, checked for contradictions, and battle-tested before going live.

03

Solver returns SAT or UNSAT

The agent's action either satisfies the policy or it does not. The decision is deterministic, not probabilistic.

04

Cryptographic receipt attached

A cryptographic, zero-knowledge proof is generated and verifiable in under a second, even across thousands of checks.

Bring a policy your risk team is arguing about.

Try the API → or Book a call →
Scaling

Oversight at human speed caps the agent at human speed.

Every governance platform promises you can scale AI with confidence. Read the mechanism, and there is a human reading a dashboard inside it.

Oversight at human speed

Confidence, capped by review capacity.

The agent runs at machine speed; the organization approves at the pace of inboxes. The gap between the two is work you cannot delegate.

Checking at machine speed

Every agent action verified. No reviewer in the hot path.

The solver checks every action before it runs, at the speed the agent works, and the receipt proves it. Humans keep the two jobs that were always theirs: writing the rules, and judging the exceptions the rules route to them.

The volume of work you can govern stops being the volume a person can review.

Third-party verification

Get a receipt for every agent action.

PreFlight is the only system that combines pre-action blocking with a portable zero-knowledge receipt: evidence that leaves the building. A log lives inside your trust boundary. The receipt crosses it. A log is a statement your system makes about itself; the receipt is a statement the math makes about your system. Your auditor can argue with the first. Nobody argues with the second.

A log entry

Your word for it

To believe a "deny" in your log, an outsider has to believe five separate things at once:

  • –the entry was not edited after the fact
  • –no entries were deleted or omitted
  • –the policy logged is the policy that ran
  • –the input logged is the input that was checked
  • –the engine ran correctly rather than someone typing "deny"

Self-attestation at machine speed is still self-attestation.

A cryptographic receipt

Proof

A mathematical artifact that cannot exist unless the computation happened:

  • +on that exact input
  • +against that exact policy
  • +producing that exact result
  • +verifiable by anyone in under a second, without trusting you or your systems
  • +revealing nothing: your policy and your data stay private
  • +tamper-evident: forging or editing it means breaking the cryptography
Deterministic

A rule decides, not a model, and a gateway can stop the action before it runs. Several platforms now offer this, and it is the right foundation.

Provable

The system records that the rule fired. That record is generated, held, and presented by the operator, inside the operator's own infrastructure.

Independently verifiable

A third party checks the math themselves: no API key, no account, no access to your systems, on any stack, without ever seeing your policy or your data. This is the rung the receipt occupies.

Proof-carrying intent

User intent.
Every agent.
One proof chain.

Intent is fixed as a checkable predicate at the root. Every downstream agent, from the orchestrator to each sub-agent, proves conformance. One broken link surfaces before any action lands.

A variant of IVC · Incremental Verifiable Computation
User · root "Buy me a plane ticket to NYC" π₀ = commit(intent) ›
Orchestrator Splits into flight search, seat, and payment sub-tasks. π₁ = extend(π₀, action) ›
Sub-agent A Finds NYC flights. Intent intact. verify(π₁) → SAT ›
Sub-agent B · drift Books LAX. Predicate violated. Blocked. verify(π₁) → UNSAT

✓ The predicate propagates untampered. Every upstream agent stays clean. Only the drifting node fails.

Introducing Verbatim

The model picks the words.
It never invents the facts.

Actions are only half of what agents produce. Verbatim is the same discipline for the words. Every price, date, and policy claim compiles into a decoding grammar, so the model is physically unable to generate a fact outside your spec. Not instructed not to. Unable to.

Ask about it

Deterministic by construction, not by prompt.

Candidate tokens
"$35 fee, waived" "sometime next week" "happy to cover that" fee.wire.domestic "$0, no charge"
↓ grammar mask ↓

"The domestic wire fee is $35.00."

Every character traced to a policy span.

Get started

Give your agents high-stakes work.

For developers

Ship verification, not judgment calls.

Compile a policy, check an agent action, get a verdict and a receipt. No subscription, and public proof verification needs no API key.

Read the docs
For risk and platform teams

Risk you can report on, not defend.

Bring the policy stuck in review. We will count the rules that are checkable facts versus genuine judgment calls and scope a pilot from there.

Book a call