sha3:df794c1cb3d709b23de5722561888470c2f1bc5767ebd7ea827fb9c6d03fba35IntactPROOF LAYER 03 / AGENCY
What the machine was allowed to do. And what would have stopped it.
sha3:6b028eba85bfIndependently verifiable1479a64c3656332c7df00d584df956452049494a5d7d8349010cc0d7f0ec8344prev:d428043d78b2A machine acted in a regulated environment. On what authority?
Q1What was the machine permitted to do?
Q2What did it actually do?
Q3What would have stopped it?
An autonomous system took an action in an environment subject to continuous monitoring. Weeks later, in a review you do not control, someone asks on what authority the machine acted. That sounds like one question. It is three, and each one is answered by a different artifact.
- the permission
- The autonomy envelope: a machine-enforced object that existed before the action, stating which action types were allowed, how many resources could be touched, at what cost, in which environments, inside which change windows.
- the act
- The evidence record: what the agent actually did, content hashed with SHA3-256 and committed to the chain, carrying the pinned before state, the hashed delta, and the rollback id.
- the counterfactual
- The gate evidence: what would have blocked this exact action had it been one notch different, produced by the same gates that screened it live.
Logs, however well collected, give you only the middle artifact. A permission written down after the fact is a memo. A counterfactual reconstructed after the fact is a guess. Both have to be produced by machinery that stood in the execution path before the action ran.
Proof of Agency holds all three, on the same chain that carries Proof of State (what your cloud was) and Proof of Change (what changed it). This page walks the three artifacts in order, then extends the same record to every model and agent acting in the tenant.
c07066db18c3daa7988d342ea5859381dd94bbc6a5933ffc4006fcc794266baaprev:1479a64c3656The envelope: what the machine was allowed to do
The envelope is not a policy document and not a configuration convention. It is an object the execution layer reads before every action, and the action either fits inside it or does not run. Every field below is a live constraint, and every evaluation of it is itself a chained record.
# one envelope per action class, versioned, machine enforced envelope env/drift-hygiene-v3 trust_mode AUTONOMOUS allowed_action_types tag.remediate nsg.rule.restrict storage.public_access.disable blocked_action_types identity.role.assign keyvault.purge resource.delete max_affected_resources 10 # blast radius, hard ceiling min_confidence 0.94 # published by the reasoning layer cost_ceiling $25 # per action, estimated before execute excluded_environments prod-ato il5-enclave change_windows Tue 02:00-04:00Z Thu 02:00-04:00Z dry_run_first required for high-impact classes emergency_stop andon cord: any operator, halts every envelope
Two structural facts follow from this shape. The reasoning layer that proposes an action publishes a confidence figure with every proposal and cannot execute anything directly; execution belongs to a separate layer that reads the envelope first. And the envelope is evaluated inside your tenant: there is no telemetry pipeline to PolicyCortex servers, so the record of every evaluation stays with the evidence it governs. Where each piece runs is drawn in the architecture.
Every envelope carries a trust mode, and the mode decides who signs.
- SHADOW
- Watch only. The reasoning layer proposes and publishes confidence; zero actions are executed. Every deployment starts here, and the self-serve evaluation at app.policycortex.com/auth (fourteen days, read only) is SHADOW by construction.
- GATED
- The default. A human approves each action: per action, per control class, per resource type, or per environment. The approving identity becomes part of the act's record.
- AUTONOMOUS
- Narrow, well-tested action classes only. All three policy gates must pass, 3/3, and published confidence must clear the envelope floor: 0.94 for high-volume drift classes.
63cdae746c09db1e6cf19a82bb06c97625614e30a551f9b69293587c1b19e566prev:c07066db18c3The act: what it actually did
Every action, in every trust mode, runs inside the same wrapper. We call it the Safety Sandwich because the action is never the first thing that happens and never the last. Each stage writes its own record to the chain, so the act arrives with its context attached.
- 00 DETECT
- The condition is observed and recorded before anything is proposed. Detection sources are inventoried per scope, so an unobserved scope is a declared gap, not a silence.
- 01 PRE-CHECK
- Blast radius bounded against the envelope. Target state pinned by hash. Policy gates evaluated: 3/3 required, or the action stops here and the stop is recorded.
- 02 DECISION
- The reasoning layer proposes a captureState and restoreState pair and publishes its confidence. It cannot execute. In GATED mode, this is where the human signs.
- 03 EXECUTE
- The action runs, inside the envelope it passed at pre-check, within the change window, under the cost ceiling.
- 04 VERIFY
- The state delta is hashed and compared to what was proposed. A mismatch triggers automatic rollback, and the mismatch is recorded either way.
- 05 ROLLBACK ID
- The record closes with an identifier that reverses this exact action through a single API call.
Rollback here is a type, not a promise. Every handler that can change your estate implements the same contract, and the runtime enforces it.
# the contract every remediation handler implements interface RemediationHandler<R> { captureState(target: R): Promise<State> apply(target: R, plan: Plan): Promise<Delta> restoreState(target: R, state: State): Promise<Restored> verify(target: R, expected: Delta): Promise<Verified> } # runtime guarantee, checked per handler: restoreState(captureState(x)) == identity(x) restoreState refuses if State.hash does not match the live state
214 handlers ship with this contract today, and the mechanism is the subject of 4 U.S. patent applications. That is the whole claim, stated once. The state pinned at 01 is a Proof of State snapshot, and the delta hashed at 04 is the same delta Proof of Change commits, so the three layers write one chain, not three logs to reconcile.
20d0e2b5752263b6f1b13d7dc4dab22b7d9d080d2493510aee3504cc2f0a8a8cprev:63cdae746c09The counterfactual: what would have stopped it
For any action the system took, the register can show what would have blocked it had it been one notch different. The gates are declarative and versioned, so the evaluation that screened the live action can be recomputed with exactly one parameter moved. Below is the shape: one executed action, then the same action pushed one notch past each constraint.
# as executed, 2026-08-31T02:41:55Z action nsg.rule.restrict resources.affected 8 envelope ceiling 10 confidence.published 0.96 envelope floor 0.94 cost.estimated $14 envelope ceiling $25 gates 3/3 PASS executed, verified, rollback id rb-004311 # the same act, one notch different, through the same gates resources.affected 11 BLOCK max_affected_resources, stopped at 01 PRE-CHECK confidence 0.93 ROUTE below min_confidence, queued for human approval cost $27 BLOCK cost_ceiling, stopped before execute environment prod-ato NEVER excluded_environments, never reaches 02 DECISION
This table can only be produced if the gate existed before the action. A log pipeline added after the fact can tell you what happened. It cannot manufacture what would have happened, because the gates that decide that were never in the execution path. When the review asks whether the 2 a.m. action could have touched a hundred resources instead of eight, the counterfactual is the difference between an answer and an assurance.
It is also why the envelope has to be a machine-enforced object rather than a document. A document constrains the people who read it. The envelope constrains the action, whether or not anyone is awake.
6e986384be4757514a9ec5a3c281a19118fe45bb81c9a42ff0e1b5e59d474e0dprev:20d0e2b57522The AI estate: every model and agent, not only ours
Agency proof is wider than our own remediation handlers. The same register inventories the models and agents acting in your tenant: which identities they hold, which channels and egress paths they use, which envelope binds them, and which techniques they are exposed to. When someone asks whether an AI system in your environment is in scope, the record answers from data, as of a date, not from a spreadsheet somebody maintains.
Exposure is mapped against MITRE ATLAS, and where no control bounds a technique, the record says so as a declared gap.
- AML.T0048
- Prompt injection. Ingress paths to each agent are enumerated, and the envelope's blocked action types cap what an injected instruction could reach if it lands.
- AML.T0051
- LLM jailbreak. A jailbroken model can change what the reasoning layer proposes. It cannot change that the proposal lands at 02 DECISION, which cannot execute directly.
- AML.T0023
- Model evasion. The detection sources feeding 00 DETECT are inventoried per scope, so an evaded or absent detector shows up as a declared gap, not as quiet.
- AML.T0024
- Training data poisoning. Recorded where training pipelines run inside connected scope, declared out of scope where they do not, so the boundary of the claim is explicit.
- AML.T0017
- Model theft. The identities and egress paths with access to model artifacts are part of the estate inventory, so the exfiltration surface is enumerable.
- AML.T0040
- Inference denial of service. Cost ceilings and change windows bound sustained invocation, and every ceiling evaluation is a chained record.
The same estate record evidences the four NIST AI RMF functions without a separate exercise.
- GOVERN
- The envelope is the governance object: written before use, versioned, machine enforced, with every evaluation recorded.
- MAP
- The estate inventory is the map: models, agents, identities, channels, exposure, as of a timestamp you choose.
- MEASURE
- Published confidence per proposal, gate results per action, hashed verify deltas per execution.
- MANAGE
- Trust modes, change windows, dry-run first, and the andon cord, with their use recorded as evidence rather than asserted in a narrative.
deac0e0e8b593ebaa67da62eb76cd587b387e7ea5456be8baeedba1d22264ba1prev:6e986384be47How the record is verified
Agency records verify the same way state and change records do, because they live in the same chain. The digest of an action record commits to the policy decision that permitted it, the envelope version it was evaluated against, the before and after state hashes, and the digest of the record before it.
A second party verifies without us in the loop. Export the stream, recompute SHA3-256 over each record plus its predecessor's digest, and compare. Verification returns one of two answers: intact, or the exact sequence number where integrity fails. Every record after a failure is invalid by construction, which is what makes editing the middle of an authority trail detectable rather than deniable.
Envelope versions are records too. When someone asks which envelope was in force at 02:14, the answer is not the current settings page. It is the envelope record the action's digest committed to, retained for seven years, regenerable to any historical timestamp.
$ pcx verify --stream agency --from 2026-08-01 recomputing sha3-256 over exported records chain: INTACT head: sha3:9b41c2e07d33 envelope_versions: 7, all committed to the chain gaps_declared: 1 (2026-02-19T22:04Z to 2026-02-21T03:11Z)
e59ef96503853b6539f096297625902d343594630e6d76987251ae1a2c0d8384prev:deac0e0e8b59What this layer does not do
df794c1cb3d709b23de5722561888470c2f1bc5767ebd7ea827fb9c6d03fba35prev:e59ef9650385Where it maps
Agency evidence files under access enforcement and continuous monitoring, and it is the artifact most assessment paths currently have nothing on file for. The mapping stays quiet: the rows below are where assessors expect to find what the sections above produce. SSP, POA&M, and SAR narratives generate from the same implementation record, exported as OSCAL 1.1.2.
- NIST 800-53
- AC-6 least privilege enforced as an envelope rather than asserted in a narrative, CA-7 continuous monitoring, SI-4 system monitoring from the same chain.
- NIST AI RMF
- GOVERN, MAP, MEASURE, MANAGE evidenced from the envelope and estate records above, not from a questionnaire.
- MITRE ATLAS
- Estate inventory annotated against AML.T0048, T0051, T0023, T0024, T0017, and T0040, with unbounded techniques recorded as declared gaps.
- MITRE ATT&CK
- Acts and detections carry technique references, so an assessor can trace a 2 a.m. action to an adversary model without leaving the record.
- CMMC Level 2 / NIST 800-171
- Agent actions produce control evidence as a byproduct, inside the same base that covers the 110 requirements.
Prove the authority behind every machine action.
Request verification