# AgenticRail — it won't let your AI skip a step

> Markdown mirror for AI agents, generated 2026-08-30 from the live page.
> Canonical: https://agenticrail.nz/
> Site context: https://agenticrail.nz/llms.txt

Deterministic enforcement · Ed25519-sealed receipts

# It won't let your AI skip the step that matters.

AgenticRail is a deterministic gate that blocks an AI agent from acting out of order — **before the action runs**, not after. Every decision it's allowed to make is sealed into a signed receipt anyone can verify offline, with no callback to us. It doesn't make the AI right. It makes the order **unskippable, and the record impossible to quietly change.** **There is no language model anywhere in it — zero AI influence on the gate itself.** No chatbot, nothing that guesses. The same request against the same sequence state returns the same verdict every time, which is what makes a decision reproducible by someone else rather than regenerated.

## The gap

The harm that leaves no trace

Almost everywhere AI now makes or drafts a decision, a human is meant to check it — and almost nowhere is there proof the check happened. The safeguard is real; the record of it is missing. That silence, not the AI's mistakes, is the dangerous part: when something goes wrong, there is nothing to point to.

## What it does

Two powers, at the one boundary you can't avoid — the moment before an AI acts.

- 1**Refuse.** A step that is out of order, replayed, or not permitted is denied — deterministically, before it runs. Not an AI guessing whether to allow it; a computed decision that can't hallucinate its own verdict.
- 2**Witness.** Every decision — ALLOW or DENY — is written to a signed, chain-linked receipt in tamper-evident storage, before the action executes. Nothing is recorded after the fact; nothing can be altered without breaking the chain.

```
agent → gate → ALLOW / DENY → sealed receipt
```

## The proof — verify it yourself

Don't take our word for it. Every receipt is signed with **Ed25519** and verifiable **offline** against a public key we publish — no callback to AgenticRail. Re-hash the record and check the signature in your own code, or paste a sequence ID into the [report tool](https://report.agenticrail.nz/report). [A worked example](https://agenticrail.nz/proof/) shows the whole thing done on a real sealed sequence: the chain, one receipt complete, and the code that verifies its signature offline.

**No sequence ID yet? Make one in two commands.** The [docs](https://agenticrail.nz/docs/) carry a copy-paste request that runs against the live gate on the public demo key — nothing to install, no sign-up. It returns a sequence ID; one more call returns that sequence's receipt with its Ed25519 signature and the exact preimage to check it against. If you would rather not open a terminal, the [browser demo](https://agenticrail.nz/demo/) drives the same gate and opens the signed report for your run in one click.

Signed receipt · illustrative shape

decisionALLOW

stepreview_and_sign

payload_hashsha256 of the exact record

signature_algEd25519

key_idk2_2026-06-07_ed25519

signaturebase64 — verify offline or at /report

sealedtrue

This one is illustrative. Generate a real one from the [docs](https://agenticrail.nz/docs/), or [in the browser](https://agenticrail.nz/demo/) →

## The AI drafted it. What proves a human checked it?

The same shape turns up wherever AI now drafts a decision. A scribe writes a [clinical note](https://agenticrail.nz/spec/nz-health/) and a clinician must review it before it is saved. A model marks an [assessment](https://agenticrail.nz/spec/nzqa-nz-education/) and a moderator must confirm it. An agent assembles a credit decision and someone must approve it before funds move. In every case the safeguard is real, it is required, and it [leaves no evidence it happened](https://agenticrail.nz/spec/enforceable-safeguards/).

This is where AgenticRail fits. Placed at the sign-off, it seals a receipt — **bound to a fingerprint of the exact artifact** — recording that this was reviewed and approved by this person, at this time, and that it cannot be altered afterward without breaking the seal.

It can't force a careful read, and it doesn't claim to. What it ends is *"the AI did it"* as an answer — and it protects the person who *did* review, by making that review provable.

## What it is — and isn't

| It is | It is not |
| Deterministic enforcement — the verdict is computed, not an AI's guess | A lie-detector for the AI. It proves *what* was done, not that the AI was *right* |
| A tamper-evident, offline-verifiable record | A stop on hallucination, or a force on human attention |
| Metadata and hashes — request inputs are hashed rather than stored, and whatever you place in `attestation` is published verbatim | A claim on your data or your governance — it is a bounded instrument. We hold the receipt signing keys today, and [who holds them is a deployment term](https://agenticrail.nz/faq/) |

## Where it comes from

AgenticRail was derived from **whakairo** — the carver's discipline, where order is law and the finished form is sealed. That lineage is the reason for the seal, not decoration on it. [The whakapapa →](https://agenticrail.nz/whakapapa/)

## Published briefs & specifications

Written to be cited, fingerprinted to be checked. Each carries a SHA-256 fingerprint you can recompute yourself.

**[Automated Decisions and the Provable Safeguard](https://agenticrail.nz/spec/enforceable-safeguards/)** — three tiers of safeguard (asserted, enforced, provable), why the difference decided Robodebt, and a five-minute test anyone can run.

**[AI in NZ Health Care: The Missing Evidence Layer](https://agenticrail.nz/spec/nz-health/)** — sector gap analysis: national AI-scribe rollout, the human-review safeguard, and the record that doesn't yet exist.

**[AI in NZ Education Assessment: The Missing Evidence Layer](https://agenticrail.nz/spec/nzqa-nz-education/)** — sector gap analysis: NCEA authenticity, moderation, and the self-attested evidence chain.

**[When the Marker Is a Machine](https://agenticrail.nz/spec/ai-marked-assessment/)** — an agreement rate is a property of a system; a challenge is about an instance. What evidence supports one AI-assisted result.

**[If AI Detectors Don't Work, What Does?](https://agenticrail.nz/spec/assessment-authenticity/)** — prohibit, detect, or record the process. Why the first two both interrogate the artifact, and what the third one changes.

**[NCEA Is Being Replaced. What Assures the Internal Assessment?](https://agenticrail.nz/spec/nzce-internal-assessment/)** — under NZCE and NZACE internal assessment becomes universal, and its moderation is still unspecified.

**[The Completeness Specification](https://agenticrail.nz/spec/completeness/)** — eight requirements (R1–R8) that separate an evidence-grade enforcement record from an ordinary log.

**[The Enforcement Specification](https://agenticrail.nz/spec/)** — the canonical spec: decision architecture, receipt fields, signing, and the sealed chain. Versioned and frozen.

**[Writing](https://agenticrail.nz/blog/)** — technical posts, each re-checked claim-by-claim against the current system before republication.

**Verify a receipt, or start a conversation.**

[What it is](https://agenticrail.nz/product/) · [Run the live demo](https://agenticrail.nz/demo/) · [Verify a sequence](https://report.agenticrail.nz/report) · [Questions](https://agenticrail.nz/faq/) · [hello@agenticrail.nz](mailto:hello@agenticrail.nz)

Hokianga Harbour Heads, Northland, Aotearoa — where AgenticRail is built

He toi whakairo, he mana tangata