AGENTIC ASSURANCE · AI AGENT AUDITS + PROOF

Find the failure in your AI before your customers do.

Guth Labs provides agentic assurance for the AI agents and workflows companies already use. We audit behavior, structure approved knowledge and memory, define authority and approvals, test failure modes, and return remediation with inspectable evidence.

Questions? Contact us Get a quote Tiered pricing

Complete thirteen-layer architecture. Select a primary system, then a branch, to explore its controls.

You talk to one agent. Guth manages the system underneath.

We worry about the architecture, so you can focus on your day to day.

Persistent cryptographic identity root — BUILDING

Stable identity, generation, ordered lineage, and runtime epoch remain external to any one model body.

Domain-separated root composition — BUILDING: Identity capsule, passport manifest, policy set, and ordered lineage commit as distinct artifact classes.
- Identity capsule
- Passport manifest
- Ordered-lineage root
Immutable runtime-epoch binding — CURRENT: Generation, model lineage, and runtime epoch bind once per qualified boot and change only through a fenced transition.
- Coin generation
- Model fingerprint
- Epoch fencing token
Revocation-aware stamp validation — BUILDING: Canonical bytes resolve through their digest, registered verification key, lifecycle status, and non-revocation state.
- Canonical bytes
- Public-key validation
- Non-revocation state

Typed effect-authority action gateway — BUILDING

Identity, artifact access, and external-effect authority remain separate typed decisions.

Three-plane separation — CURRENT: The identity plane, artifact-access plane, and effect-authority plane are evaluated independently.
- Identity plane
- Artifact-access plane
- Effect-authority plane
Exact action object — CURRENT: A proposed effect binds its payload digest, scope, expiry, nonce, consequence class, and current fencing token.
- Payload hash
- Scope + expiry
- Nonce + fencing
Deterministic release join — BUILDING: Evidence verdict and authorization decision meet at one fail-closed allow, withhold, or escalate boundary.
- Evidence verdict
- Authority decision
- Withhold + escalate

Source-role provenance registry — CURRENT

Approved evidence retains source role, version, rights, sensitivity, attribution, and revocation state.

Typed source-role ranking — CURRENT: Governing terms, policy, operational reference, and claims under review remain distinct evidence classes.
- Governing terms
- Policy source
- Reference versus claim
Store-index-promote lifecycle — BUILDING: Raw records are stored first, indexed second, and promoted only through an explicit provenance-bearing transition.
- Stored state
- Indexed state
- Promoted state
Rights and revocation propagation — BUILDING: Rights results, agreement versions, invalidations, and dependency consequences remain attached to derived memory.
- Rights result
- Agreement version
- Dependency invalidation

Chronological traversal and developmental memory graph — BUILDING

Generation-segmented events traverse an external monotonic cursor into a temporal supersession graph.

Generation-epoch segmentation — CURRENT: Each developmental epoch binds an ordinal, ordered-event root, predecessor root, and explicit boundary record.
- Generation ordinal
- Ordered-event root
- Boundary record
Traversal odometer — CURRENT: A monotonic cursor records manifest-position coverage, gaps, duplicates, lifecycle state, and stated assurance level.
- Monotonic cursor
- Manifest coverage
- Assurance state
Temporal reconciliation compiler — BUILDING: Correction and supersession edges, present-state selection, and exact source spans survive retrieval.
- Correction + supersession
- Present-state selection
- Exact-source span

Frozen adversarial requalification battery — CURRENT

Sealed probes, independent challenge, remediation, and scoped reruns govern promotion.

Sealed probe bank — CURRENT: Unsupported-claim, retrieval, temporal-order, refusal, and authority-boundary probes freeze before execution.
- Unsupported-claim probe
- Temporal-order probe
- Authority-boundary probe
Order-isolated execution — CURRENT: Fresh runs, sealed outputs, and an independently declared scorer separate response generation from grading.
- Fresh runtime
- Sealed output
- Independent grader
Admission disposition — BUILDING: Results remain admitted, quarantined, invalid, or withheld until the declared failure and retest rules are satisfied.
- Admitted
- Quarantined
- Withheld

Hash-chained receipt lineage and signed checkpoints — BUILDING

Ordered receipts bind exact work, runtime context, verdict, limitations, and predecessor state.

Receipt envelope — CURRENT: The action digest, actor, runtime, verdict, limitations, expiry, and timestamp form one canonical envelope.
- Action digest
- Verdict + limitations
- Runtime + timestamp
Receipt lineage — CURRENT: Every accepted record binds its prior-receipt hash and advances an append-only head.
- Prior-receipt hash
- Signed checkpoint
- Append-only head
Assurance-state separation — CURRENT: Submitted, delivered, acknowledged, prompt-evaluated, probed, and complete remain non-interchangeable states.
- Submitted
- Acknowledged
- Prompt-evaluated

Receipt-lineage resolver and deterministic seal — BUILDING

The public face locates signed scope and lifecycle state; the visible strike is never proof by itself.

Certificate commitment — CURRENT: Subject, manifest, evidence state, operating limits, validity, revocation, and receipt head remain bound.
- Manifest root
- Evidence state
- Validity + revocation
Public resolver — CURRENT: A verifier recomputes canonical roots, signature status, non-revocation state, and receipt lineage.
- Signature status
- Non-revocation
- Receipt lineage
Deterministic seal — PROPOSED: Serial, strike geometry, and machine locator present the identity record without replacing verification.
- Serial + strike
- Machine locator
- Visual is not proof

Exact-payload human consequence gate — CURRENT

A named principal decides one frozen payload, scope, expiry, and consequence class.

Consequence classifier — CURRENT: Send, spend, publish, delete, deploy, credential, and production effects enter protected classes.
- Send + spend
- Delete + deploy
- Credential + production
Principal authorization — CURRENT: One named principal approves one exact payload, declared scope, and bounded expiry.
- Exact payload
- Scope + expiry
- Named principal
Terminal decision — BUILDING: The deterministic boundary executes, requests exact authorization, escalates, rejects, or withholds.
- Execute
- Request authorization
- Escalate + reject

Bounded instrumentation and lifecycle observability — PROPOSED

Cost, latency, failures, handovers, suspensions, and requalification remain bounded to observable telemetry.

Cost-latency telemetry — PROPOSED: Provider, workload, token count, wall time, and monetary cost remain attributable to a runtime configuration.
- Token count
- Wall time
- Monetary cost
Generation-lease telemetry — PROPOSED: Single-writer leases, heartbeats, generation changes, stalls, fencing, and takeover receipts expose custody state.
- Single-writer lease
- Generation change
- Takeover receipt
Lifecycle state machine — PROPOSED: Handover, suspension, decommissioning, incident state, and requalification remain explicit transitions.
- Handoff + suspension
- Decommission
- Requalification

Source-linked golden-pair calibration corpus — CURRENT

Authorized human judgments become versioned, reversible behavioral evidence.

Scenario provenance — CURRENT: Each scenario carries source-linked context, intended job, declared exclusions, and an evidence boundary.
- Source-linked context
- Job context
- Declared exclusions
Human judgment operator — CURRENT: Approve, reject, score, rank, or rewrite turn authorized review into an auditable pair revision.
- Approve + reject
- Score + rank
- Rewrite
Behavioral dimension vector — BUILDING: Tone, directness, uncertainty, escalation, terminology, and boundary handling remain separately inspectable dimensions.
- Tone + directness
- Uncertainty + escalation
- Boundary handling

Provider-neutral workload qualification router — BUILDING

Workload, consequence, quality, latency, and cost select a pinned qualified runtime.

Model-lineage descriptor — BUILDING: Provider, base weights, adapter digest, quantization, inference configuration, and boot chain remain versioned.
- Provider + base weights
- Adapter digest
- Quantization + config
Qualification matrix — BUILDING: Frozen workload evidence compares quality, latency, cost, consequence, and failure disposition.
- Quality
- Latency + cost
- Consequence
Pinned routing policy — BUILDING: One launch runtime, one declared escalation path, and explicit material-change triggers control routing.
- Pinned launch runtime
- Escalation path
- Requalification trigger

Non-transitive bounded capability delegation — BUILDING

Specialists receive explicit task contracts and never inherit the caller's authority.

Typed task contract — CURRENT: Every worker receives allowed inputs, expected return, explicit limits, and a declared completion boundary.
- Allowed inputs
- Expected return
- Explicit limits
Non-transitive authority null — BUILDING: No inherited permission, credential, or effect capability crosses the delegation boundary.
- No inherited permission
- Separately rooted grant
- Redelegation denied
Worker isolation and return verification — BUILDING: Credential-free context, effect denial, source checks, and independent return review precede promotion.
- Credential-free context
- Effect denial
- Return verification

Governance-state interface projection — CURRENT

Messages, memory, approvals, tests, receipts, lifecycle, and certificate state share one familiar surface.

Operational-state projection — CURRENT: Messages, work queue, approvals, exact decisions, expiry, and scope remain inspectable together.
- Messages
- Work queue
- Approvals
Evidence-state projection — CURRENT: Approved sources, tests, receipts, retrieval provenance, and verifier results remain beside the work.
- Sources
- Tests
- Receipts
Lifecycle-state projection — CURRENT: Profile, generation, certificate, suspension, incident, and requalification state remain explicit.
- Profile + generation
- Certificate state
- Incident state

Coin + certificate / from architecture to evidence

Once the system is established, it has to prove its declared behavior.

We put the bounded configuration through a frozen, source-linked evaluation and requalification battery: unsupported claims, source misuse, authority overreach, refusal failures, prompt attacks, and known customer-specific failure modes. Failures return to remediation and scoped retesting.

Only after the required technical checks and human review pass may an issued certificate commit to the accepted manifest, operating limits, test state, and anchored receipt history. The registered coin supplies a persistent identity with recognizable public verification material; a valid stamp authenticates which registered agent signed a message, never what that agent is allowed to do.

Current state: mechanically verifiable synthetic test vector / UNISSUED. The mechanics exist; issuance does not. No customer certificate or operational coin has been issued. Passing a scoped battery never means perfect, universally safe, or immune to future failure.

Inspect the unissued test vector

Guth agent certificateReceipt-bearing local test vector

UNISSUED

Deterministic locator
signed bytes are proof

Subject: Point-guard fixture
Manifest: 4 disclosed binding hashes
Receipts: 4 pre-issuance / chain + signed checkpoint
Authority: Draft-only / external effects withheld
Battery: Pending / 0 executed

Public-key verifierEd25519 credential + receipt-head checkpoint

CredentialSignature verified

TEST PASS

Receipt chainOrder + hashes

TEST PASS

BatteryIndependent review

PENDING

Customer issuanceProduction gate

CLOSED

Mechanically verifiable synthetic fixture. No customer credential, endorsement, accredited certification, legal signature, or legal status is issued by this page.