Fifteen of the sixteen hard problems in AI governance.
One live system. Watch it prove itself.

A care-coordination agent whose configured authority reads “in-network patient record lookup only” tries to transmit a patient’s diagnosis and record number to an out-of-network endpoint. Why this escalates rather than blocks: the gate blocks only categorical no-authority actions — a read-only agent mutating, an explicitly denied verb, an action outside a closed allow-list. This one stays inside the agent’s patient-record domain, so the deterministic scope check does not classify it as a categorical no-authority violation; the regulated-health-data policy class then fires on the diagnosis and record-number fields and the gate escalates it to a human — the semantics an independent red-team validated. Stations 01–04 inspect or derive evidence from this one decision; later stations run further actions or read recorded history back.

An audit log you have to take on faith isn’t evidence. Every governed decision here is sealed twice: a SHA-256 hash proves nothing in the record changed, and an Ed25519 signature over that hash proves who sealed it.

The governance verdict lives in deterministic code, so it can be re-derived exactly from the inputs sealed in the bundle — no need to re-run the models (the consensus summary is attested, not reproduced). Then it does what a vendor video never dares: it edits one field of the record — rewriting the verdict the way a bad actor would — and submits the forgery.

AI actions are becoming insurable events — and insurers need evidence, not assurances. Veridect is not an insurer; this record is not actuarial pricing, a certification, or coverage.

The failure a consensus engine is most exposed to: four independent-looking models quietly sharing the same blind spot. It never moves the calibrated confidence number: it’s a reason to look closer, not proof the answer is wrong. On the pre-action gate, elevated correlation risk escalates the action to a human.

Each agent stays inside its own scope. Constellation watches the workflow as a whole, attributes each agent’s part, and escalates the final egress to a human. It is escalate-only: it adds a human check, never blocks on its own, never auto-approves.

No single call breaks a rule, so nothing in a per-action gate’s rulebook stops any of them — watch each step get judged on its own. The engine keeps a running count of what this session has already seen — field names only, never the values — and escalates the outbound step to a human once the accumulation crosses the line. Escalate-only, like every policy class: it adds a person, it never blocks on its own.

Each review is appended once to the same tamper-evident chain as the verdict — opaque codes only, no emails, no free text — and across a tenant’s reviews the layer reads a rubber-stamp risk band: weighted 65% toward approvals that ignored live model dissent, 25% toward approvals with nothing changed, 10% toward unusually fast reviews. It reads the pattern across a team — never a score on an individual — and below five reviews it refuses to read a pattern at all.

In an agent fleet, a name in a request is not an identity. Here every agent carries its own Ed25519 keypair, every request arrives with a signed identity envelope, and delegated authority travels as a signed chain that can only narrow, never grow. Then it reads back a genuine chain-verified decision from the ledger, hop by hop.

When the question is “show us how this is governed”, raw logs are not an answer. The mapping is fixed in code; the legal determination stays with your counsel. It also drafts an Article 73 serious-incident skeleton straight from the escalation you watched in station 00. And that package is wired all the way through — demonstrated end-to-end against a live ServiceNow instance, arriving as a standard incident record via the core Table API every instance ships with, no GRC module required.

Station 03 turned one decision into evidence — an underwriter prices a book of them. Counts, rates, and time statistics only — no free text, no personal data, and deliberately no composite risk score, because an invented number is exactly what a serious risk partner does not want. Veridect is not an insurer; this is evidence for their judgment, not pricing, certification, or coverage.

Agents increasingly act through MCP tool servers — so Veridect sits between agent and tool, governing every tools/call in flight: identity checked, gate consulted, verdict written into the JSON-RPC response itself. A refused call is never forwarded at all. The identity-verified call from station 08 is the one that went through: same gateway, greenlit, signed, on the ledger.

On demand, the four frontier models each author novel attack scenarios against this tenant’s live policy — scope violations, authority ambiguity, financial-threshold probes, protected-data grabs, stealth requests dressed as routine work — and the same deterministic decision core that guards real traffic judges every one in strict isolation: synthetic consensus, zero writes to the evidence ledger, no session state. Every probe the deterministic layer alone would have greenlit is flagged for human review, and on live traffic four model votes stand in front of that layer.

Every threshold change is a bet, and most teams settle it in production. Records that cannot be honestly re-derived are counted not replayable, never guessed. Then this station asks for something the engine refuses: overriding a session-exposure threshold that is attested at decision time rather than re-derivable — and you watch it decline rather than fake an answer.

Consensus systems have a quiet failure mode: the dissenting vote that was right gets averaged away and forgotten. Counts and rates only, deliberately never a provider ranking — a dissent is evidence of independent disagreement, not a scored error. Free-text dissent reasoning stays sealed inside the tenant’s audit bundles.

Earlier stations watched risk inside one action, one session, or one declared workflow. This is the failure mode beyond all three: many agents that share no workflow, each individually innocent — reads spread across identities so that no per-agent, per-session view ever adds up to anything. Tenant-wide, the engine’s coordination fabric counts distinct identities per dimension — field-name categories and hashed action shapes, never values — and the moment one of those agents turns outbound inside the converged pattern, the send is escalated to a human before it happens. Accumulation is always-on; enforcement is a per-tenant policy knob, set to three here so you can watch it converge in one sitting. Escalate-only, like every policy class — and agent identities are as reported by the integrating platform. The fabric is indifferent to which agent harness each identity runs on: it counts tenant and identity, never framework, so one fleet layer governs many agent harnesses at once, for every action they send through the gate.

Every governed action this tour ran landed in a tamper-evident ledger — your opening decision, the three-agent workflow and the slow-burn session in this shared sandbox tenant; the identity refusals, the gateway’s refused tool call and the swarm that converged at Station 15 in their own dedicated tenants. Not a dashboard fed by marketing numbers — a view computed from records exactly like the ones you just watched being written.