action_hash
Fingerprints the exact action. Change one character of the payee or the amount and it no longer matches.
A PRAXENOR PRODUCT
Veristade
The notary for AI agents.
Veristade decides whether each agent action may run, then keeps a proof of why that anyone can check later. Refused by default. Allowed only with proof. Written down either way.
Product in development. Design-partner pilots on infrastructure you control. No hosted service yet. Patent pending.
- seq
- 42
- timestamp_unix
- 1790080237
- request_id
- "req_8fade64b69"
- verdict
- "REFUSED"
- reasons
- ["not_in_signed_plan", "no_human_signature"]
- requires
- []
- action_hash
- "8fade64b69b6cf0adfc2f0ffb1cdec2296f5c906abed8ad1dc7d1cf09e59c2e5"
- policy_hash
- "add697a10a43b1b0e8129dfc98c2f10ca13effac242f510c67da2d019dbd596a"
- prev_hash
- "409a021d8338b9387e75fc1c4d1e8ef3b721cfebfb0849a0ed3f2ca4e4d046cb"
- self_hash
- "e17107bc4086c6ef66b693d24b8c1c45c42d59b4c03c9521ed29d6d4eb616e40"
INSIDE A RECEIPT
Every receipt answers
the questions an auditor asks.
The receipt above is complete: a refused wire transfer, in the gate's own field layout. Here is what each field is for.
policy_hash
Fingerprints the policy in force. A later policy can’t be passed off as the one that made this call.
verdict · reasons
Record the call in plain English. For held actions, requires names what would unlock it, such as one person’s signature.
timestamp_unix
Read from the gate’s clock, never taken from the agent that asked.
prev_hash · self_hash
One seals the receipt before it, the other seals this one. Edit any receipt and the chain stops adding up.
Anyone
A receipt is plain data and SHA-256. Your auditor can verify a whole ledger with a few lines of code, without trusting us or the agent.
WHERE THE TRUST COMES FROM
A decision is only as good
as the facts under it.
Veristade accepts facts from three places, and none of them is the agent.
- Identity
- A pinned client certificate over mutual TLS. An agent can’t claim to be someone else.
- Approval
- A person’s Ed25519 signature, bound to one request. It can’t be replayed or reused.
- Time
- Read at the gate, never from the caller.
Nothing an agent writes, and nothing a prompt injection writes through it, can become a fact.
The honest edge: the people you trust are still the root of trust. If someone with authority signs a bad plan, Veristade can’t stop it. It labels where each decision’s authority came from, so that signature is provable, never hidden.
SIGNED PLANS
Approve the plan,
not every step.
Approval fatigue is how human review fails. Sign forty things a day and you start rubber-stamping, which is worse than no review at all because it looks like review.
With a signed plan, a person authorizes the task once. Every step is checked against that plan. A step that isn’t in it, including one an injected instruction slipped in, matches nothing and is refused.
Signatures a week
Set the shape of your team’s agent work.
410signatures, approving every step
10signatures, approving each plan once
400 fewer signatures to rubber-stamp every week, with every step still checked.
WHAT A REFUSAL SOUNDS LIKE
Plain English first.
Proof underneath.
A CISO can read the reason. An engineer can check the proof under it.
- RefusedThe agent that raised this purchase order can’t approve it. Segregation of duties is a fact Veristade looks up, not a score it tunes.
- RefusedThe task runs under a signed plan, and this step matches no entry in it. An injected instruction can’t spend an entry that was never signed for it.
- Refused, unconditionallyNo approval, role, or token unlocks this action. Some doors don’t have keys.
- HeldPaying a new vendor needs one person’s signature. The request waits; it doesn’t run.
- RefusedDestroying data needs a person’s signature. None was present.
WHERE TEAMS PUT IT FIRST
Start with the workflow
where a wrong action costs the most to explain.
One agent, one policy written with you, and a readout of everything it tried.
- Payments and treasury agents
- Payments run only inside a signed plan. New payees wait for one person’s signature. A wire an email asked for goes nowhere, and the refusal is on the record.
- Agents near patient or member data
- Some actions have no unlock at all. Every read and every refusal carries the policy version and the reason, ready for a compliance review.
- Procurement and back-office agents
- The agent that raises a purchase order can’t approve it. Refunds and record changes follow the rules you’d hold a new employee to, and you can prove they did.
STATUS
What works today,
and what doesn’t yet.
A security product that overstates itself has already failed its first test.
Works today
- Default-deny policy engine written in Rust; the engine itself has no third-party dependencies
- Agent identity from pinned client certificates over mutual TLS
- Approvals as Ed25519 signatures bound to one request
- Signed plans: approve once, check every step
- Hash-chained receipts for every decision, allowed or refused
- Plain-English reasons with the proof underneath
Building now
- A live console reading your own ledger
- One-command start and stop for pilots
Not yet
- A hosted service
- SOC 2 report or other certifications
- A published list of integrations
From internal tests, September 2026: 2,000 randomized requests were checked against a separately written reference model with zero actions allowed without a permit. Not an external audit. We walk design partners through the tests line by line.
COMMON QUESTIONS
Know what
you’re looking at.
No mystery claims. No assumed integrations.
Is this a prompt-injection filter?
No. A filter tries to recognize dangerous text, and it fails open when it misses. Veristade never needs to recognize it. Text can’t become a fact, so an action without real proof doesn’t run, however convincing the text was.
Does Veristade make my agent’s decisions correct?
No, and be wary of anyone who says their product does. Veristade makes sure an action was permitted by your policy and proves it. Writing a good policy is part of every pilot.
What can’t it stop?
A person with real authority signing something they shouldn’t. The people you trust are still the root of trust. Veristade makes that signature provable, not impossible, and labels on every decision where the authority came from.
What happens when an action is refused?
It doesn’t run. The agent gets a plain-English reason it can act on, and you get a receipt. Actions that need a person are held until someone signs or declines.
Where does it run?
As a gateway in front of the tools and systems your agents call, on infrastructure you control. There’s no hosted version yet.
Is Veristade certified for SOC 2 or HIPAA?
No. It holds no certifications today. We’ll tell you exactly what it does and doesn’t cover for your use case.
DESIGN PARTNERS
Put one agent
behind it.
One workflow, a policy written with you, and a readout of everything the agent tried: what ran, what didn’t, and why.
Apply for a pilot