---
title: "AI: the engine, and the cage that makes it safe"
description: "Xovyr generates remediation proposals by grammar-constrained reasoning and cannot execute. A policy gate rules before, formal verification proves after, a rollback identifier exists before any change."
url: https://policycortex.com/ai
sealed: 2026-09-01
amended: 2026-09-05
register: ai
records: 8
digest: sha3:ad9bc62916ee5ba8440f4aedee5cc4fbdd6c211327d23c3a87d02abf9bb51192
---

# We built the engine. Then we built the cage.

AI governance

Xovyr generates remediation proposals by grammar-constrained compositional reasoning. It cannot execute anything. Between every proposal and your infrastructure stand a policy gate that rules before, a formal proof that checks after, and a rollback identifier that exists before any change. This page shows that structure.

**In one paragraph.** The engine is called Xovyr. It generates remediation proposals by grammar-constrained compositional reasoning and publishes a confidence figure with each one; it holds no credentials and has no execution path. The cage is deterministic: an OPA policy gate rules before, SMT formal verification proves the drafted plan before it lands, and a rollback identifier is armed before any change.

[Request Access](https://app.policycortex.com/auth?mode=request-access) · [Read the authority record](https://policycortex.com/proof/agency)

## The engine is not the product. The cage is.

Every vendor in this market has an AI engine now. Ours is called Xovyr, and this page will show it to you. But an engine is not what makes it safe to let software modify regulated infrastructure at two in the morning. What makes that safe is the structure around the engine: a gate that rules on every proposal before it moves, a proof that checks every change after it is drafted, and a reversal path that exists before anything is touched. We built the engine first. Then we spent the harder years building the cage. The cage is what we sell.

- **the.engine**: Xovyr. It generates remediation proposals by grammar-constrained compositional reasoning and publishes a confidence figure with each one. It holds no credentials and has no execution path. Its entire output is a proposal object.
- **the.cage**: The Safety Sandwich. An OPA policy gate rules before the engine reasons. Terraform planning with SMT formal verification proves the change after it is drafted and before it lands. A rollback identifier is armed before any modification. AI proposes; deterministic gates verify.
- **the.record**: Every gate ruling, proof result, and rollback arming is hash chained into the same record that carries Proof of State, Proof of Change, and Proof of Agency. The cage does not ask to be believed. It writes evidence.

The mechanism is the subject of 4 U.S. patent applications, including Neuro-Symbolic Policy Reasoning and an Autonomous Cloud Governance Engine. That is the whole provenance claim, stated once.

## Xovyr: an engine that can only propose.

Xovyr does not free-generate infrastructure changes. It composes them inside a grammar: a closed vocabulary of action types, parameters, and targets that the reasoning is constrained to at generation time, not filtered against afterward. A change that would fall outside the grammar is not caught later. It cannot be formed. That is the difference between telling a model what not to say and giving it a language in which the forbidden sentence does not exist.

The engine publishes a confidence figure with every proposal, and the figure is recorded whether or not the action ever runs. But what the engine cannot do is the load-bearing fact on this page: it holds no credentials, it has no execution path, and its output is inert until the cage rules on it. A hallucinating model with write access to production infrastructure is a catastrophe. A hallucinating model whose only output is a proposal object headed into a deterministic gate is a Tuesday.

## The Safety Sandwich, walkable.

The cage has four load-bearing members, and every proposal passes through them in order. Each member is deterministic: same input, same ruling, every time. Each writes its own chained record, so the act arrives with its context attached. Walk them.

- **00 OPA PRE-GATE**: Before the engine reasons at all, an Open Policy Agent gate rules on the condition and its scope against the autonomy envelope and every applicable policy as code. ALLOW moves the work forward. DENY is a chained record, not a silence, and nothing the engine produces can route around this member.
- **01 THE GRAMMAR**: Xovyr composes the remediation inside a closed grammar of permitted action types. This member is structural rather than evaluative: an out-of-grammar action is unrepresentable, so the proposal that would need catching never comes to exist.
- **02 SMT VERIFY**: The proposal is rendered as a Terraform plan, and the plan's postconditions are proved by SMT formal verification against the policy constraint set. Proved for the stated properties, before anything lands. A failed proof stops the walk, and the failure is recorded.
- **03 ROLLBACK ARM**: The target state is captured and hashed, and a rollback identifier is issued before any modification. If the identifier cannot be armed, execution is refused. The reversal exists before the act does.

One sentence carries the whole architecture: AI proposes, deterministic gates verify. The engine is probabilistic, and we treat that as a property to be contained rather than denied. Everything that touches your infrastructure is deterministic, evaluated in order, and recorded.

## Who holds the key: three trust modes.

A cage with no lock is scenery. Every autonomy envelope carries a trust mode, and the mode decides whether a human signs before member 03 arms. SHADOW watches and executes nothing; every deployment starts there. GATED, the default, puts a named human approval on each action, and the approving identity becomes part of the act's record. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs every member of the cage on every act.

The full trust-mode record, including graduation and the andon cord, is on [the agency record](https://policycortex.com/proof/agency). This page states only who holds the key: you do.

## The cage watches the other AI too.

Ours is not the only model acting in your tenant. The same record inventories every model and agent in scope: the identities they hold, the channels and egress paths they use, the envelope that binds them. Xovyr is entry one on that inventory, held to the same rows as every other agent. Shadow AI, meaning a model or agent operating outside the inventory, is detected and surfaces as a finding, and a finding closes only one of two ways: the entry is claimed and bound to an envelope, or it is removed on the record. The inventory never shrinks silently.

- **inventory**: Models and agents enumerated with identities, channels, egress paths, and binding envelope, as of a timestamp you choose. This is the annual AI use-case inventory, answerable from data rather than from a spreadsheet somebody maintains.
- **MITRE ATLAS**: Exposure mapped against 64 ATLAS adversarial techniques, with unbounded techniques recorded as declared gaps rather than omitted. The six techniques most probed in review are itemized in Proof of Agency.
- **prompt.injection**: Ingress paths to each agent are enumerated. An injected instruction can change what a model proposes. It cannot change that the proposal lands in the cage, which cannot be talked out of a DENY.
- **token.cost.anomaly**: Sustained anomalous invocation is treated as a security event, not a billing footnote. Cost ceilings are gate inputs, and every ceiling evaluation is a chained record.

The full estate record, including the per-technique ATLAS ledger and the counterfactual machinery that replays any act one notch different, lives in [Proof of Agency](https://policycortex.com/proof/agency#ai-estate). This record states what is watched. That one proves it.

## September 2026 is not a forecast.

OMB M-25-21 requires agencies to classify high-impact AI and to have minimum risk management practices in place for it. The deadline for those minimum practices is September 2026. Annual AI use-case inventories are already due on a cycle, and the DOE AI Compliance Plan asks the same questions of the laboratories. Contractors are not addressees of the memo, but the obligations arrive anyway, as evidence their federal customers must produce and therefore must demand. Every one of those obligations reduces to the questions this record answers: what AI is acting in the environment, what was it permitted to do, what did it do, and what would have stopped it.

- **OMB M-25-21**: High-impact AI classification and minimum risk management practices. The envelope, the trust modes, and the chained gate records are those practices, in force and evidenced, rather than described in a memo. The classification judgment itself stays with your accountable official: the record holds it, your CAIO makes it.
- **NIST AI RMF**: GOVERN is the envelope. MAP is the estate inventory. MEASURE is published confidence and gate results per action. MANAGE is trust modes and the andon cord. All four are evidenced from the records above, not from a questionnaire.
- **DOE AI Compliance Plan**: Use-case inventory, risk determination, and documented safeguards, answerable from the estate record as of a date.
- **MITRE ATLAS**: Adversarial technique exposure per agent, with unbounded techniques declared as gaps.

If the minimum practices exist only as narrative, the deadline is a writing assignment. If they exist as machine-enforced objects with chained evaluations, the deadline is an export. This mapping is our reading, not legal advice; the memo and your counsel control.

## How the cage is audited.

Every member of the cage writes a record: the OPA ruling with the policy version it applied, the proposal with its grammar version and published confidence, the SMT result with the constraint set it proved against, and the rollback identifier with the state hash it captured. Each record commits to the digest of the record before it, SHA3-256, on the same chain that carries every other proof layer.

A second party verifies without us in the loop. Export the stream, recompute the digests, compare. The answer is intact, or the exact sequence number where it is not. When a reviewer asks whether the gate actually ruled before the act, the ordering is not asserted by us. It is arithmetic.

## What the cage does not do.

**Stated limit.** The cage does not make the engine smart. If Xovyr proposes a wrong action inside its envelope, the gates bound the damage and the record shows why it stopped where it did. Bounded is the claim. Infallible is not.

**Stated limit.** SMT verification proves the stated properties of the plan, not every property of the world. Properties outside the constraint set are outside the proof, and the constraint set is versioned and inspectable, so the boundary of the claim is explicit.

**Declared gap.** A jailbroken or injected model can change what is proposed. It cannot change that the proposal enters the cage, because the gates hold their own authority. What the cage cannot govern is an agent operating entirely outside governed credentials and channels; its effects surface as unattributed drift in [Proof of Change](https://policycortex.com/proof/change), and the record declares them as unattributed rather than guessing at an author.

Walk the cage in your own tenant. [Request Access](https://app.policycortex.com/auth?mode=request-access)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | THE CLAIM | dce8f9081dec | 60826bf389da |
| REC 0001 | THE ENGINE | 74c7075093dc | dce8f9081dec |
| REC 0002 | THE CAGE | 98edaf7c900b | 74c7075093dc |
| REC 0003 | THE KEY | e433298b24bb | 98edaf7c900b |
| REC 0004 | THE ESTATE | d78568260093 | e433298b24bb |
| REC 0005 | THE DEADLINE | a12940988bd0 | d78568260093 |
| REC 0006 | VERIFICATION | 12e98010b093 | a12940988bd0 |
| REC 0007 | STATED LIMIT | ad9bc62916ee | 12e98010b093 |

Head sha3:ad9bc62916ee5ba8440f4aedee5cc4fbdd6c211327d23c3a87d02abf9bb51192. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.