--- title: "Proof of Agency" description: "Hash-chained evidence of what an autonomous system was allowed to do, what it did, and what would have stopped it. The envelope, the act, the counterfactual." url: https://policycortex.com/proof/agency sealed: 2026-08-31 amended: 2026-09-05 register: proof/agency records: 8 digest: sha3:d3c3c8bcd4929ef595c6dd5cae25ad7f56811db6a4f2be2e29a5beba42451581 --- # What the machine was allowed to do. And what would have stopped it. Proof of Agency An agent acted in your tenant at 02:14. The log line proves the act happened. It does not prove the machine had authority to act, and it cannot prove what would have stopped a larger act. Proof of Agency records all three artifacts: the envelope, the act, and the counterfactual. **In one paragraph.** Proof of agency holds three artifacts for every autonomous action: the envelope that permitted it before it ran, the chained record of what it did, and the counterfactual showing what would have blocked it had it been one notch different. Envelope versions are records too, so the authority in force at 02:14 is read from the chain. [Request Access](https://app.policycortex.com/auth?mode=request-access) ยท [How it runs in your tenant](https://policycortex.com/architecture) ## A machine acted in a regulated environment. On what authority? Q1. What was the machine permitted to do? Q2. What did it actually do? Q3. What would have stopped it? An autonomous system took an action in an environment subject to continuous monitoring. Weeks later, in a review you do not control, someone asks on what authority the machine acted. That sounds like one question. It is three, and each one is answered by a different artifact. - **the permission**: The autonomy envelope: a machine-enforced object that existed before the action, stating which action types were allowed, how many resources could be touched, at what cost, in which environments, inside which change windows. - **the act**: The evidence record: what the agent actually did, content hashed with SHA3-256 and committed to the chain, carrying the pinned before state, the hashed delta, and the rollback id. - **the counterfactual**: The gate evidence: what would have blocked this exact action had it been one notch different, produced by the same gates that screened it live. Logs, however well collected, give you only the middle artifact. A permission written down after the fact is a memo. A counterfactual reconstructed after the fact is a guess. Both have to be produced by machinery that stood in the execution path before the action ran. Proof of Agency holds all three, on the same chain that carries [Proof of State](https://policycortex.com/proof/state) (what your cloud was) and [Proof of Change](https://policycortex.com/proof/change) (what changed it). This page walks the three artifacts in order, then extends the same record to every model and agent acting in the tenant. ## The envelope: what the machine was allowed to do The envelope is not a policy document and not a configuration convention. It is an object the execution layer reads before every action, and the action either fits inside it or does not run. Every field below is a live constraint, and every evaluation of it is itself a chained record. Two structural facts follow from this shape. The reasoning layer that proposes an action publishes a confidence figure with every proposal and cannot execute anything directly; execution belongs to a separate layer that reads the envelope first. And the envelope is evaluated inside your tenant: there is no telemetry pipeline to PolicyCortex servers, so the record of every evaluation stays with the evidence it governs. Where each piece runs is drawn in the [architecture](https://policycortex.com/architecture). Every envelope carries a trust mode, and the mode decides who signs. - **SHADOW**: Watch only. The reasoning layer proposes and publishes confidence; zero actions are executed. Every deployment starts here. Read-only onboarding uses this mode after access is reviewed and the deployment scope is agreed. - **GATED**: The default. A human approves each action: per action, per control class, per resource type, or per environment. The approving identity becomes part of the act's record. - **AUTONOMOUS**: Narrow, well-tested action classes only. All three policy gates must pass, 3/3, and published confidence must clear the envelope floor: 0.94 for high-volume drift classes. ## The act: what it actually did Every action, in every trust mode, runs inside the same wrapper. We call it the Safety Sandwich because the action is never the first thing that happens and never the last. Each stage writes its own record to the chain, so the act arrives with its context attached. - **00 DETECT**: The condition is observed and recorded before anything is proposed. Detection sources are inventoried per scope, so an unobserved scope is a declared gap, not a silence. - **01 PRE-CHECK**: Blast radius bounded against the envelope. Target state pinned by hash. Policy gates evaluated: 3/3 required, or the action stops here and the stop is recorded. - **02 DECISION**: The reasoning layer proposes a captureState and restoreState pair and publishes its confidence. It cannot execute. In GATED mode, this is where the human signs. - **03 EXECUTE**: The action runs, inside the envelope it passed at pre-check, within the change window, under the cost ceiling. - **04 VERIFY**: The state delta is hashed and compared to what was proposed. A mismatch triggers automatic rollback, and the mismatch is recorded either way. - **05 ROLLBACK ID**: The record closes with an identifier that reverses this exact action through a single API call. Rollback here is a type, not a promise. Every handler that can change your estate implements the same contract, and the runtime enforces it. 214 handlers ship with this contract today, and the mechanism is the subject of 4 U.S. patent applications. That is the whole claim, stated once. The state pinned at 01 is a Proof of State snapshot, and the delta hashed at 04 is the same delta Proof of Change commits, so the three layers write one chain, not three logs to reconcile. ## The counterfactual: what would have stopped it For any action the system took, PolicyCortex can show what would have blocked it had it been one notch different. The gates are declarative and versioned, so the evaluation that screened the live action can be recomputed with exactly one parameter moved. Below is the shape: one executed action, then the same action pushed one notch past each constraint. This table can only be produced if the gate existed before the action. A log pipeline added after the fact can tell you what happened. It cannot manufacture what would have happened, because the gates that decide that were never in the execution path. When the review asks whether the 2 a.m. action could have touched a hundred resources instead of eight, the counterfactual is the difference between an answer and an assurance. It is also why the envelope has to be a machine-enforced object rather than a document. A document constrains the people who read it. The envelope constrains the action, whether or not anyone is awake. ## The AI estate: every model and agent, not only ours Agency proof is wider than our own remediation handlers. The same record inventories the models and agents acting in your tenant: which identities they hold, which channels and egress paths they use, which envelope binds them, and which techniques they are exposed to. When someone asks whether an AI system in your environment is in scope, the record answers from data, as of a date, not from a spreadsheet somebody maintains. The standing federal obligations this estate record answers are tabulated on the AI governance page. Exposure is mapped against MITRE ATLAS, and where no control bounds a technique, the record says so as a declared gap. - **AML.T0048**: Prompt injection. Ingress paths to each agent are enumerated, and the envelope's blocked action types cap what an injected instruction could reach if it lands. - **AML.T0051**: LLM jailbreak. A jailbroken model can change what the reasoning layer proposes. It cannot change that the proposal lands at 02 DECISION, which cannot execute directly. - **AML.T0023**: Model evasion. The detection sources feeding 00 DETECT are inventoried per scope, so an evaded or absent detector shows up as a declared gap, not as quiet. - **AML.T0024**: Training data poisoning. Recorded where training pipelines run inside connected scope, declared out of scope where they do not, so the boundary of the claim is explicit. - **AML.T0017**: Model theft. The identities and egress paths with access to model artifacts are part of the estate inventory, so the exfiltration surface is enumerable. - **AML.T0040**: Inference denial of service. Cost ceilings and change windows bound sustained invocation, and every ceiling evaluation is a chained record. The same estate record evidences the four NIST AI RMF functions without a separate exercise. - **GOVERN**: The envelope is the governance object: written before use, versioned, machine enforced, with every evaluation recorded. - **MAP**: The estate inventory is the map: models, agents, identities, channels, exposure, as of a timestamp you choose. - **MEASURE**: Published confidence per proposal, gate results per action, hashed verify deltas per execution. - **MANAGE**: Trust modes, change windows, dry-run first, and the andon cord, with their use recorded as evidence rather than asserted in a narrative. ## How the record is verified Agency records verify the same way state and change records do, because they live in the same chain. The digest of an action record commits to the policy decision that permitted it, the envelope version it was evaluated against, the before and after state hashes, and the digest of the record before it. A second party verifies without us in the loop. Export the stream, recompute SHA3-256 over each record plus its predecessor's digest, and compare. Verification returns one of two answers: intact, or the exact sequence number where integrity fails. Every record after a failure is invalid by construction, which is what makes editing the middle of an authority trail detectable rather than deniable. Envelope versions are records too. When someone asks which envelope was in force at 02:14, the answer is not the current settings page. It is the envelope record the action's digest committed to, retained for seven years, regenerable to any historical timestamp. ## What this layer does not do **Stated limit.** Proof of Agency does not make an agent smarter, and it does not make the agent's vendor accountable. It bounds what the agent can do inside your tenant and records the boundary. If a model is wrong within its envelope, the envelope is why the damage stopped at ten resources, and the record is how you know. **Declared gap.** An agent operating entirely outside governed credentials and channels is outside the envelope. Its effects surface as unattributed drift in [Proof of Change](https://policycortex.com/proof/change), and the record declares them as unattributed rather than guessing at an author. We would rather hand you a declared gap than a manufactured attribution. ## Where it maps Agency evidence files under access enforcement and continuous monitoring, and it is the artifact most assessment paths currently have nothing on file for. The mapping stays quiet: the rows below are where assessors expect to find what the sections above produce. SSP, POA&M, and SAR narratives generate from the same implementation record, exported as OSCAL 1.1.2. - **NIST 800-53**: AC-6 least privilege enforced as an envelope rather than asserted in a narrative, CA-7 continuous monitoring, SI-4 system monitoring from the same chain. - **NIST AI RMF**: GOVERN, MAP, MEASURE, MANAGE evidenced from the envelope and estate records above, not from a questionnaire. - **MITRE ATLAS**: Estate inventory annotated against AML.T0048, T0051, T0023, T0024, T0017, and T0040, with unbounded techniques recorded as declared gaps. - **MITRE ATT&CK**: Acts and detections carry technique references, so an assessor can trace a 2 a.m. action to an adversary model without leaving the record. - **CMMC Level 2 / NIST 800-171**: Agent actions produce control evidence as a byproduct, inside the same base that covers the 110 requirements. Prove the authority behind every machine action. [Request Access](https://app.policycortex.com/auth?mode=request-access) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | THE QUESTION | 1479a64c3656 | d428043d78b2 | | REC 0001 | THE ENVELOPE | 753be6f18e82 | 1479a64c3656 | | REC 0002 | THE ACT | 10603e2f4c8e | 753be6f18e82 | | REC 0003 | THE COUNTERFACTUAL | dd61b580d4ae | 10603e2f4c8e | | REC 0004 | THE AI ESTATE | 5f25cd2bc0b6 | dd61b580d4ae | | REC 0005 | VERIFICATION | 6dc123ee8773 | 5f25cd2bc0b6 | | REC 0006 | STATED LIMIT | 860a77b90e8d | 6dc123ee8773 | | REC 0007 | FRAMEWORK MAP | d3c3c8bcd492 | 860a77b90e8d | Head sha3:d3c3c8bcd4929ef595c6dd5cae25ad7f56811db6a4f2be2e29a5beba42451581. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.