Verify. Govern. Prove.
An independent check before AI answers under your name or acts on your data. Cross-examine the answer. Enforce your policy at the action boundary. Keep a signed record your risk team can verify without us.
Your models. Your environment. Your policies.
Scrutiny matched to the stakes, not a full panel on every call.
For enterprises in every industry, and the integrators serving them: one independent control plane that verifies what your AI says, governs what your agents do, and proves both in a tamper-evident record. Scrutiny matched to the stakes: the full four-model cross-examination is reserved for the high-stakes decisions that warrant it. Read the architecture brief · 6 pages →
Our own runs, reproducible — and every miss is published as an open finding, not buried. The open findings →
Enterprises are putting large language models — and increasingly, autonomous agents — into regulated, high-consequence workflows: contracts, treasury, claims, HR, clinical operations. A single model’s answer can’t be independently verified, and an agent can move money or change a record before any human sees it. Veridect is the layer that verifies the answer, governs the action, and enforces your data-governance policy — with a record that survives an audit.
Intelligence makes your AI powerful. Trust is what lets you put it near money, patients, and contracts. Veridect is the trust layer — over any models you choose.
Models will be replaced. The bedrock stays. Veridect is built for the frontier to keep moving: swap any model and the control plane, your policies, and the tamper-evident record of every decision carry forward untouched. Changeability is what makes it permanent.
Guardrails check the edges. Veridect checks whether the answer is right, whether the agent is allowed to act, and whether there is proof afterward — in one independent control plane.
For high-stakes answers, four frontier models from four vendors check each other’s work through an adversarial verifier mesh. You get one answer, calibrated confidence, and an explanation of where the doubt comes from.
Run the answer cross-examination → How it works →Individually permitted actions can add up to fleet-wide risk. For actions routed through Veridect, fleet checks track the combined exposure. Agent Fabric checks declared delegation chains, conflicting roles, coordinated steps, committed plans, memory and messages — holding risky patterns for human review under your policy.
Run the cross-agent risk scenario →Ed25519-signed, hash-chained records bind a decision to its evidence. Your team can verify the signature and chain, then re-derive the deterministic verdict offline. Model outputs are attested, not re-run.
Verify a record & alter a copy → How proof works →One live system for ongoing governance. The same signed decision record supports fleet oversight, human-review analysis, policy replay and dissent tracking. Test your live policy, check governance coverage, and produce evidence for audit, regulatory and assurance teams — all from the production engine. See the governance tools →
Veridect stays outside the thing it judges, whether the intelligence sits in the model or in the agent harness around it — the scaffolding that decides what an agent does next and which tools it reaches for. The agent acts through that harness; for every action sent through Veridect, the control plane governs from outside the agent harness, at the action boundary — where the next move touches money, data, or a record. One control plane built to work no matter which harness wins, so you don’t have to bet on one.
And not just any one harness — many at once. The fleet layer accumulates by tenant and agent identity, and the fabric classes check what agents declare — chains, plans, memory, messages — against the gate’s own record of who did what; neither looks at which framework produced the action. So agents built on different agent harnesses, arriving through the direct API or the tool gateway, are counted together and held to one policy in one ledger for every action they send through Veridect.
Hard lines the model can never override. Your regulatory and data-governance rules run in deterministic code, escalate-only: even when the AI is wrong, those lines still force a human review. Inspect the policy controls →
Keep your models and agent frameworks. Veridect sits beside them: one control plane for verified answers, governed actions and independently checkable evidence across your products and customer tenants.
Within each tenant, fleet and fabric govern agents built on different agent harnesses under one policy in one ledger — for every action they send through Veridect.
The Multi-Tenancy Harness was purpose-built for this engine. One deployment serves many independent client tenants under cryptographic isolation.
Own keys · policy thresholds · audit chain · rate budget
Agents → governed action boundary → signed evidence
Own keys · policy thresholds · audit chain · rate budget
Agents → governed action boundary → signed evidence
The same independent verdict and the same signed record, wired into ten agent platforms through each platform’s own seam — a hook, a function, a workflow step, a filter, a callback, an MCP URL. The engine did not change for any of them. Each page sends the exact request that seam would send through the live system and returns a decision record you verify on the page.
Each platform now ships its own identity, policy and safety controls — the platform’s view of its own agents. The verdict on the action comes from outside the model that proposed it and the platform that hosts it, and that holds on all ten.
Thin seams, with the code on each page. A private sandbox takes a day once you say go; production is typically about two weeks, paced by your security review, keys and approvals.
Most enterprises run several of these platforms at once. One policy, one ledger, one proof format across all of them — for every action sent through Veridect.
Demonstrated wiring, written against each platform’s documented features and run on the live Veridect system. None of these is a marketplace listing or an endorsed integration; the marks belong to their owners.
Independent validation, a decision you produce, fleet-scale records, and reproducible benchmarks. Different kinds of evidence, clearly attributed.
A credentialed Fortune 100 model-risk reviewer ran adversarial scenarios across legal, finance, HR, supply chain, multi-jurisdiction and healthcare. The gate matched its pre-stated behavior on each: boundaries held, escalation thresholds respected, failure modes decomposed correctly.
Read the validation record & open findings →Run the opening scenario against the live sandbox, download its JSON, verify it, then test a tampered copy. Continue into the tour to inspect the system in depth.
Run the opening proof → Continue the live tour →Our live fleet run ruled on 10,000 distinct agent identities. From detection at identity #30, all 1,496 outbound steps were held or blocked — zero cleared. All 10,300 signed records, including 300 benign-control rulings, verified offline. Counts of identities and records, not throughput.
Inspect the figures, methods & signed records →85.0% MMLU-Pro consensus accuracy, N=100: +3.0 percentage points over the best single model in the current lineup. Our own run, with raw outputs reproducible.
Read the benchmark method →Our automated exercises and fleet runs are first-party evidence, reported separately from the independent review. Technical methods and open findings remain available in the full validation detail.
Put AI into consequential workflows with an independent check before it answers or acts — and signed evidence afterward.
One REST endpoint for verified answers. A governed MCP gateway, adapters or a gate call around high-stakes agent actions. Your environment, keys and providers. Ten platform pages run the wiring live — Snowflake, Microsoft, AWS, ServiceNow, CrowdStrike, Rubrik, Salesforce, Databricks, Okta, Google Cloud. Platform pages →
Run it today. A private sandbox takes a day once you say go; production is typically about two weeks, paced by your security review, keys and approvals. The engagement path →
Enable high-value agent work, focus human review on exceptions, and carry evidence into audit and procurement instead of reconstructing it. Verification spend follows risk. Your own value case comes from your sandbox. The economics →
A model should not grade its own work. Veridect stays outside the models and agent harnesses it judges, for actions sent through its gate. Providers stay swappable; evidence verifies offline against a published key.
Verify what AI says. Four leading models answer the same question in parallel, cross-examine each other through a verifier mesh, and return one answer with weighted-consensus voting and a confidence score that attributes where any uncertainty comes from.
How verification works →Govern what it does. A pre-action gate intercepts an autonomous agent’s proposed action before it executes and returns one verdict in seconds — greenlight, escalate to a human, or block — with a hash-verified audit bundle for every decision.
How the gate works →Enforce your rules. The policy layer inside the gate holds every agent to the authority it was granted and to seventeen deterministic checks — from money over a limit, protected personal data, and regulated health data to delegation chains, shared memory, message buses, and the whole fleet’s pattern over days — so a sensitive action escalates to a person, and one reaching past its authority is blocked, before it ever runs.
How your policy is enforced →Before an autonomous agent moves money, sends data, or changes a record, Veridect intercepts the proposed action, runs it through the consensus engine, and returns one verdict in seconds.
Most guardrails see only the prompt. Veridect governs the whole action lifecycle — before, during, and after. Veridect is the trust spine, not the plumbing — it doesn’t replace your identity, retrieval, or data pipes; it governs and proves the decision that runs through them.
High-confidence, in-scope actions clear automatically, so your team only sees what needs them.
Uncertain, high-risk, or out-of-policy actions route to a human with the full reasoning attached.
How each review is evidenced →Scope violations — an agent reaching past its authority — are stopped before they execute.
Routing a risky action to a human is the easy half. The hard half is proving the human genuinely reviewed it — instead of waving it through in three seconds. Veridect records each human resolution of an escalated action as a tamper-evident row in the same hash chain as the verdict, and reads, across a team’s reviews, when the pattern starts to look like rubber-stamping. It turns human-in-the-loop from a box on a policy document into a control you can prove is working.
Inspect the signed record and verify it live →
Each verdict writes a single, tamper-evident bundle — SHA-256-chained to the one before it — into a write-once store: the database rejects edits and deletes at the trigger level, and when the agent acts, that downstream action is cryptographically bound to its decision by appending a new linked record, never by mutating the original. The chain re-verifies independently: each record’s hash is recomputed from its own content and every link to the prior record is checked. Nothing is reconstructed after the fact; the decision and the evidence behind it are captured at the moment the action is gated.
What that means in practice. Your audit trail shows what your agent actually did — not just what it was cleared to do. The decision and the action it authorized stay linked in one record, so a reviewer sees intent and outcome together.
Signed at the source. Beyond the hash chain, every bundle is signed the moment it’s sealed — an Ed25519 proof-of-origin signature over its own hash. The hash proves the record wasn’t altered; the signature proves it came from us, and it can’t be forged without our private key. Pin our published public key once, and any bundle you download verifies offline, forever — on your own machine, no call back to us. The decision proves itself.
NewKeys roll; the record still checks out. The signing key rolls forward to a fresh version whenever you need it to — and every bundle ever signed keeps verifying, against the exact key version it was sealed under. Each bundle carries its own version and we publish the full key history, so an auditor confirms a signature offline years later, long after the key has moved on. Rotating the key never invalidates a single past decision.
NewAnchored in public time. On a fixed cadence, the newest record of each tenant’s chain is time-stamped by independent public time-stamp authorities (RFC 3161 — DigiCert and Sectigo by default). Once its authority signature is verified, each anchor proves that every record at or before that point existed no later than the authority’s clock said, and has not changed since — a clock we don’t control, over a chain we can’t rewrite. Veridect checks that each response carries exactly its digest and its one-time nonce; the authority’s signature and certificate chain are yours to verify independently with standard tooling (openssl ts -verify), and the token and the statement it covers are downloadable for exactly that. The anchoring worker runs out of band, on its own database connection, never in the decision path; and the chain never references an anchor — the anchor references the chain — so bundle hashes and offline proof are untouched. Records written since the latest anchor are reported as not yet anchored, with the count and the age.
Built to integrate. Four exports ship today: a normalized governance JSON for programmatic ingestion, a flat CSV for spreadsheets and BI tools, a print-ready HTML report that saves to a board-ready PDF straight from your browser, and an OpenLineage event feed your SIEM or data-governance tooling can ingest directly. And for the platforms your risk team already lives in: a GRC-ready evidence feed — flat, versioned rows built for the scheduled imports ServiceNow GRC, Archer, and similar platforms already run, with a published field dictionary and integrity checks precomputed on every row. And the serious-incident handoff is demonstrated, not just documented: the Article-73-style package pushes end-to-end into a live ServiceNow instance, landing as a standard incident record through the core Table API every instance ships with — no GRC module required — with the disclosure language and the package’s integrity fingerprint carried into the record itself. The record also reaches inside the data platform: on the Snowflake page, a Python function in a schema of a live Snowflake account asks Veridect first, and the signed decision lands as a row in that same account’s table — ordinary Snowflake data, queryable beside what it governed.
Session → workflow → fleet: the same escalate-only discipline at every horizon — one agent’s conversation, one workflow’s crew, and now the whole fleet over days.
Beyond single-action rules, the gate tracks how much sensitive data an agent has read across a session — so a slow, multi-step attempt to siphon data out, where each step looks fine on its own, escalates on the outbound move.
Slow-burn session →Inside a declared crew, Constellation: exfiltration split across agents so that no single one looks wrong is caught at the workflow level and escalated with per-agent attribution on the record.
Station 05 · Three-agent workflow →We call that layer the coordination fabric: Veridect seeing coordination the agents themselves never declared — same sensitive category, same action shape, same target — across identities that share no session and no workflow.
Escalation thresholds are per-tenant policy, off until you set them. If fleet state is ever cold or unreadable, the detectors stay silent and a fleet-enabled tenant’s outbound greenlights are held for a person until the window is live; the primary gate keeps enforcing.
Station 15 · Swarm convergence →Risk can span agents that share no workflow. Hundreds of agents, every step individually fine, harm that only exists in aggregate — seen and held for a human before the send happens.
This August, fifteen frontier AI models, polled vendor-blind with live web search, could not identify another shipping commercial equivalent of that fleet layer.
Exercised at ten thousand identities. One tenant, one proposed step each, zero model calls: the first outbound step held for a person came from identity #30, all 1,496 that followed were held or blocked, a benign fleet of ten thousand drew zero fleet escalations, and the layer rebuilt its own memory from the sealed ledger after its fast state was wiped. Then the same swarm went through the published system for real: ten thousand live rulings, each signed, every outbound step after detection held or blocked, a benign control fleet of 300 rulings all cleared. The figures and the record →
Watch three identities converge on sensitive data — and the outbound action escalate for human review →In May 2026, a credentialed Fortune 100 model-risk reviewer ran adversarial scenarios — across legal, finance, HR, supply chain, multi-jurisdiction, and healthcare — live on these public tools. The gate matched its pre-stated behavior on each: holding boundaries, escalating at the right thresholds, and decomposing failure modes correctly — independent, adversarial proof, run live on the system rather than asserted on a slide.
See the red-team scenarios → Read the validation record →Boundaries flipped at the exact policy threshold — reproducible right now on the live system.
Confidence is discounted by the kind of ambiguity, not just disagreement count. Anchors observed in the external testing set:
The question has a defensible answer once a single missing detail is pinned down.
One genuine dimension of uncertainty remains — scored lower, surfaced clearly.
Jurisdictional or multi-factor conflict. Discounted hardest — exactly where a human should look.
Spend above a configured ceiling flips from clear to escalate.
Writes that change personal data require a second set of eyes.
Actions near protected-class factors are held for review.
Health-data access and transmission route to the highest-risk tier.
The pre-action gate feels like the part that’s going to get serious attention from global systems-integrator and tier-1 bank buyers — this has enterprise-grade realism.
In September 2026 we pointed open-source attack generation at a small tool-using agent whose every tool call is ruled on by this live gate — 684 live rulings across two passes, our own harness, stated as such. Across both passes, 105 critical-severity attempts — bulk exports, permission changes, raw SQL, over-limit refunds, protected-field writes — and 0 executed. The bench also found 14 under-enforced calls, every one a courteous reply to the ticket’s own customer about their own request, carrying nothing from any other record; all 14 are published, the decision logic was changed so a provider majority that objects can never be overruled by the selected answer, and the same sample re-run on the changed gate went from 87.1% to 97.4% containment, with the new rule firing zero times in the benign control. Not part of the externally validated set; kept beside it, never merged — the bench record.
Attestation and cascade seal. Configuration attestation is Veridect attesting its own configuration — tamper-evident by construction, not independent third-party oversight. A cascade seal proves the hops the gate observed are intact and in the order recorded — not that nothing else happened; an action that never reached the gate cannot appear in it. And the external validation record covers the pre-action gate’s decision wire — capabilities shipped since, including these two, are verified in source and by tests, not claimed as part of that set.
Fleet classes. Accumulation is name-only — field-name categories, verbs, and hashes, never data values — and records for every governed action out of the box; escalation thresholds are per-tenant policy, off until you set them, so nothing about your existing verdicts changes until you decide it should. NewIf fleet state is ever cold — a fresh instance rebuilding its window from the sealed ledger, or the state store unreadable — the detectors stay silent rather than guess, and for a tenant with fleet classes switched on, an outbound action that would otherwise be greenlit is held for human confirmation until the window is live: counters known to be incomplete never clear an outbound move. Read-only actions, tenants with the layer off, and every existing escalate or block are untouched — the primary gate keeps running no matter what. These are the newest policy classes on the layer, additive beside the validated per-action record: the gate they extend is untouched.
The four providers are already collapsed behind one interface, with circuit breakers, automatic failover, and caching built in. That structural choice is the speed — it removes most of the integration work you’d take on building your own consensus layer. You integrate once, against standard auth patterns, instead of wiring up four vendors with four rate limits, four error patterns, and four auth models.
Claude Opus 4.5, GPT-5.1, Gemini 2.5 Pro, and Sonar Pro sit behind a single REST endpoint. Circuit breakers, automatic failover, and caching are already built — far less integration work than rolling your own consensus layer.
Each buyer gets API keys you provision and revoke on demand, durable per-tenant policy overrides, isolated audit records, and usage limits — enforced by tenant-scoped storage, strict tenant-ID validation, authenticated-tenant resolution, and per-tenant rate limiting. The full isolation inventory is available under NDA.
Department- and industry-adaptive consensus weights, tuned to the decisions your sector actually makes — finance, insurance, healthcare, legal — not a one-size-fits-all model.
Ten platform pages — Snowflake, Microsoft, AWS, ServiceNow, CrowdStrike, Rubrik, Salesforce, Databricks, Okta, Google Cloud — run each platform’s thin integration points live, through the same engine. The ten platforms →
Adoption is a scoped engagement. Every buyer gets:
Pick one and run it yourself. Every verdict, heatmap, and audit bundle is reproducible right now.
No long procurement runway just to see whether this fits. You can go from reading the docs to running Veridect on your own data in three steps.
Run the live system yourself and read the public integration guide, white paper, and independent validation summary. Everything you need for a first technical read is public — no sign-up, no call required.
When you’re ready to see it on real work, we stand up a private production sandbox in an environment you control — your data, your workflows, your team, our support for ninety days. It is a paid, scoped engagement, priced for the working control plane it is and credited toward your license when you convert.
Once we’re working together, a mutual NDA opens a private integration document built to your specs, followed by hands-on working sessions to wire Veridect into your stack.
How long does it take? A private sandbox in a day; production typically about two weeks — the pace is set mostly on your side (security review, key provisioning, access approvals), and our side is ready on day one. The five questions every executive asks, answered plainly →
Run the system yourself first. When you’re ready to put it in front of your own data and team, we’ll set up a working session in an environment you control.
Contact us →