The gap
Almost everywhere AI now makes or drafts a decision, a human is meant to check it — and almost nowhere is there proof the check happened. The safeguard is real; the record of it is missing. That silence, not the AI's mistakes, is the dangerous part: when something goes wrong, there is nothing to point to.
What it does
Two powers, at the one boundary you can't avoid — the moment before an AI acts.
- 1Refuse. A step that is out of order, replayed, or not permitted is denied — deterministically, before it runs. Not an AI guessing whether to allow it; a computed decision that can't hallucinate its own verdict.
- 2Witness. Every decision — ALLOW or DENY — is written to a signed, chain-linked receipt in tamper-evident storage, before the action executes. Nothing is recorded after the fact; nothing can be altered without breaking the chain.
agent → gate → ALLOW / DENY → sealed receipt
The proof — verify it yourself
Don't take our word for it. Every receipt is signed with Ed25519 and verifiable offline against a public key we publish — no callback to AgenticRail. Re-hash the record and check the signature in your own code, or paste a sequence ID into the report tool. A worked example shows the whole thing done on a real sealed sequence: the chain, one receipt complete, and the code that verifies its signature offline.
No sequence ID yet? Make one in two commands. The docs carry a copy-paste request that runs against the live gate on the public demo key — nothing to install, no sign-up. It returns a sequence ID; one more call returns that sequence's receipt with its Ed25519 signature and the exact preimage to check it against. If you would rather not open a terminal, the browser demo drives the same gate and opens the signed report for your run in one click.
This one is illustrative. Generate a real one from the docs, or in the browser →
The AI drafted it. What proves a human checked it?
The same shape turns up wherever AI now drafts a decision. A scribe writes a clinical note and a clinician must review it before it is saved. A model marks an assessment and a moderator must confirm it. An agent assembles a credit decision and someone must approve it before funds move. In every case the safeguard is real, it is required, and it leaves no evidence it happened.
This is where AgenticRail fits. Placed at the sign-off, it seals a receipt — bound to a fingerprint of the exact artifact — recording that this was reviewed and approved by this person, at this time, and that it cannot be altered afterward without breaking the seal.
It can't force a careful read, and it doesn't claim to. What it ends is "the AI did it" as an answer — and it protects the person who did review, by making that review provable.
What it is — and isn't
| It is | It is not |
|---|---|
| Deterministic enforcement — the verdict is computed, not an AI's guess | A lie-detector for the AI. It proves what was done, not that the AI was right |
| A tamper-evident, offline-verifiable record | A stop on hallucination, or a force on human attention |
Metadata and hashes — request inputs are hashed rather than stored, and whatever you place in attestation is published verbatim | A claim on your data or your governance — it is a bounded instrument. We hold the receipt signing keys today, and who holds them is a deployment term |
Where it comes from
AgenticRail was derived from whakairo — the carver's discipline, where order is law and the finished form is sealed. That lineage is the reason for the seal, not decoration on it. The whakapapa →
Published briefs & specifications
Written to be cited, fingerprinted to be checked. Each carries a SHA-256 fingerprint you can recompute yourself.
Verify a receipt, or start a conversation.
What it is · Run the live demo · Verify a sequence · Questions · hello@agenticrail.nz
