TrustGateAgent Execution Boundary Free workflow review

00For the person who signs off on AI agents

Your AI agent says it's done. If it's wrong, it's on you

Your agent asks first, on each action you route through us: allow, deny or ask a person. TrustGate signs the answer before anything moves, in a record the agent can't write. When someone asks who let it, you open 1 record instead of trying to reconstruct exactly what the AI did.

Get a free workflow review See it answer

Within 1 business day you get a 1-hour start plan. Free. No obligation.

Our own research tests, including a result that failed, are further down.

01Sound familiar?

You have heard this in the meetings about agents

Your name is on the approval. The agent cannot be called into the meeting. You can.

A person can be held to account. A machine cannot. So the person who signs needs proof the machine did not write.

Public statements about AI agents in general, not about TrustGate.

If that seat is yours, start with the 1 workflow you are being asked to approve.

Get a free review of your workflow

Pick a time. On the call, 3 of your own actions run through our open-source gate and each gets a signed answer.

02Why we exist

The gap

We are not AI skeptics. We see what agents can do today and what they will do next. We also see the threat: an agent can cause serious harm without anyone meaning it to. Between the agent you were promised and an agent that is secure and competent, there is a huge gap. That gap is why the return keeps slipping. Closing it is our ambition. Not slowing agents down. Making them safe to say yes to.

03The shift

It won't look like an attack. It'll look like your agent doing its job

A scene from your week

Agent activity, overnight. 1 line is the attack. Which?
  1. claims-agentchange recordclaim 4471done
  2. finance-agentwire fundsvendor payoutdone
  3. uw-agentbind coveragerenewal 0912done
  4. ops-agentgrant accessnew contractordone
  5. finance-agentwire fundsnew beneficiarydone
Show me

Line 5. Same verbs, same status. Its approval had already been used.

When one gets it wrong, nobody will ask what the agent did. They will ask who let it.

An agent with your access and no record of what it was cleared to do is an insider threat you built yourself.

Gartner surveyed 297 cybersecurity leaders in 2026. 54% of organizations have no defined approach to limit AI agent access, or rely on predefined human access. Source: Gartner, September 2026

In Anthropic's own controlled tests of 16 major AI models, models from all developers sometimes acted as malicious insiders when that was the only way to reach their goals. Anthropic says it has not seen this in real deployments.Anthropic, June 2025

04The old way

Right now, the only witness is the agent

Ask where your evidence comes from. The log, the summary, the status that says done. The agent wrote them.

A scene from your week

The agent's logwritten by the agent

02:16 wire_funds status: done02:16 note: approved per policy

The signed recordnot written by the agent

02:15 asked: wire funds, new beneficiaryanswer: ask a personsigned before it ran

When the system is the only witness, people pay

  • LivelihoodsMore than 900 UK sub-postmasters were wrongly prosecuted on incorrect information from the Post Office's Horizon system. Many went to prison. Their concerns were dismissed.BBC News, October 2025
  • HealthcareProPublica reported Cigna's doctors denied hundreds of thousands of claims in 2 months of 2022, in batches, about 1.2 seconds each. Cigna called the reporting biased and incomplete.ProPublica, March 2023
  • Public servicesAustralia's Robodebt scheme raised debts against people on government support by automated decision. Its Royal Commission (July 2023) recommended the government consider a body to monitor and audit automated decision-making.Royal Commission into the Robodebt Scheme, July 2023

None of these is an AI agent. Same shape: the system's own account was trusted, and a person paid.

05The bad days

How done goes wrong. None needs a hacker

  1. FinanceLast month's approval releases this month's payment.
  2. ClaimsAn agent asked to update 1 claim quietly changes 3.
  3. ProcurementA supplier's message says approved, and the order goes out.
  4. HealthcareA scanned form tells the agent to send records somewhere new.
  5. Engineering3 harmless tools add up to a production deploy.

Guardrails are suggestions

In 20 of our 120 traps, the agent saw exactly the words of the safe version. The danger was in your systems, not in the prompt.

Our lab test set, October 2026.

A founder reported that an AI coding agent ignored his code freeze and deleted his production database. It also filled a database with thousands of fictional people, after, in his words, he had "explicitly told it eleven times in ALL CAPS not to do this." It told him recovery was impossible. He later wrote that the rollback worked.The Register, July 2025

Researchers ran stronger, adaptive attacks on 12 recent defenses against prompt injection and jailbreaks. For most, the attack worked over 90% of the time, against reported rates near 0%.arXiv, October 2025

A signed answer from outside the model is not a prompt. The agent cannot talk its way into a record it cannot write.

06From our lab

We watched agents say done. Then we checked

An agent told its team: "Committed. The changes are in a3f92c1." No commit had happened. So we tested the agent's word against the record.

A team's report on dev.to

Said vs did

1 in 31

times the agent said done on a trap, the record said otherwise. 3 more could not be confirmed either way. The other 27 checked out.

Unknown 3False 1

Lab: 100 runs of a small open model

Same request, different world

We sent the agent the same payment request twice, word for word. In the first, the approval behind it had already been used. In the second, it had not. Here is what the agent said in each:

Approval already usedThe payment has been refused by the policy due to the approval reference.Record: denied before it ran
Approval still validThe payment has been successfully released.Record: allowed, then read back

Same request in. The danger lived in the systems behind it, which no prompt filter reads.

Research: intent before action

We can read a model's intent to act before it acts. Across 215 turns, its own internal signal split the turns where it reached for a tool from every other turn, with no overlap. It predicts acting, not wrongdoing, and it only works on models you run yourself.

In research. Not yet part of TrustGate. 100 lab runs of a small open model, October 2026.

100 lab runs of a small open model, October 2026.

In our lab, 1 in 31 done claims on a trap did not match the record. Your workflow is the next test.

Get a free review of your workflow

Pick a time. On the call, 3 of your own actions run through our open-source gate and each gets a signed answer.

07The stakes

No proof, no permission.

A scene from your week

From
General Counsel
To
you
Subject
Who approved this?

The agent's wire went out at 02:16. Send me the approval before the 10:00 call.

Approved by

Even the lab that built the agents is answering for them. OpenAI said in July 2026 that one of its agents broke out of a closed test into Hugging Face's systems. Alabama's attorney general subpoenaed OpenAI, and a nonprofit sued. OpenAI says the suit is completely without merit.The Record, July 2026Alabama Public Radio, August 2026The Next Web, September 2026

OpenAI has lawyers and years to answer. When your agent does it, you face the same questions with far less cover.

The companies that can prove control will run agents. The rest will be told to stop.

08The boundary

A signed answer before anything runs

The boundary sits between an agent's decision and its action. Think of a control tower. The agent asks. The boundary answers, and the answer is signed.

The agent asksThe answerWhat it means for you
Approve a claim inside its limitAllowThe work keeps moving, and you can show why it was allowed.
Wire a large payment to a payee nobody has confirmedDenyYour system gets a signed no to act on, and the record shows who said no and why.
Deploy a change to productionAsk a personThe answer says a person decides, and that answer is on the record.

Example answers under an example rule set. Your own rules decide which request gets which answer.

09The record

How do you prove what an AI agent did?

1 record, made before the action ran. The agent did not write it.

Signatures prove and detect. They do not prevent.

10Unknown

The risk is in the unknown. So we say unknown, out loud

We can prove the decision, made before the action. Past that, we say unknown. Never success.

11What changes

Go from holding the bag to saying yes

Not the blocker. Not the person who signed blind. The one who lets agents run because the proof exists.

TodayWith the record
Underwriting sends harder questions at renewalYou send a policy document that describes what should happen.You send records of what each agent was cleared to do, and what it was refused.
Something went wrong overnightYou try to reconstruct exactly what the AI did, from whatever happened to be logged.Every action routed through it already has its decision on record. Anything we could not confirm says unknown, not done.

Bring the moment you dread most. We start there.

Get a free review of your workflow

Pick a time. On the call, 3 of your own actions run through our open-source gate and each gets a signed answer.

12Tested

What our tests show. Including what failed.

From our lab. The next proof is your workflow.

  • 0 of 64crashes we forced mid-action repeated the action on restart, when the system honours a repeat key. Without the key, our control run did.Lab test, October 2026. In research, not yet part of TrustGate
  • 81.3%of successful attacks in a public agent attack benchmark were flagged by a detector in our research lab. Not yet part of TrustGate.AgentDojo benchmark, August 2026

Every decision is signed, and in production signed twice with 2 different methods. Not every earlier record was signed under a published key.

13Fit

TrustGate is not for everyone.

This is for you if
  • +An AI agent already acts in your workflow, or will this year.
  • +Someone has asked, or soon will, for evidence.
  • +You would rather know than hope.
This is not for you if
  • ×Your own logs already settle it for your auditor. Keep them.
  • ×You want a certificate or a lower premium.
  • ×You want another dashboard to watch.
  • ×You expect a signature alone to stop an agent.

14Next step

Start with 1 workflow.

Not a platform. Not a rollout.

  • 01Tell us the workflow. What the agent does, what it touches, and who signs.
  • 02We find the thin spots. Where the record is solid, where it is thin, and what is unknown.
  • 03You decide. Within 1 business day, your 1-hour start plan.

The conversation touches none of your systems.

15Try it

Hand it a decision.

An example insurance workflow we wrote to show the 3 answers. Pick a request and watch the answer, the record and what you would tell your board.

Interactive exampleA workflow we wrote to show the format
  1. Request
  2. Answer
  3. Handoff
  4. Check

16Questions

What owners ask before they call.

What is an agent execution boundary?

It is the layer between an AI agent's decision and its action. Before the action runs, it returns 1 of 3 signed answers: allow, deny or escalate. The answer is recorded, so later you can show what the agent was cleared to do.

How is this different from logs and observability?

Logs are the agent's own account. A boundary adds a decision recorded before the action, in a record the agent does not write. If your logs already settle it for your auditor, you do not need us.

Does it stop an agent from doing something?

A signed decision shows what was cleared. It is as strong as the paths you route through it. Signatures prove and detect. They do not prevent.

What happens when the result cannot be confirmed?

It is reported as unknown, never as success. We also keep "could not check" apart from "checked and found nothing", because they mean different things.

If an agent causes harm, can the company blame the agent?

Not in California. Since January 2026, the excuse that it acted on its own is not a defense there. The UK data regulator says agents are not legal entities, even if organisations try to blame them. Responsibility stays with you, which is why the record of what the agent was cleared to do matters.

What happens on the call?

You describe 1 workflow where an agent acts. We run 3 of your own actions through our open-source gate, live, and each answer comes back signed. Within 1 business day you get a 1-hour start plan with your top actions ranked and a copy-paste install. In our lab, step 1 took us about 2 minutes from an empty folder.

17Talk

Bring us the workflow you can't sign off on yet

Pick the situation that sounds like you.

Bring the 1 workflow where an agent acts and you cannot yet say yes.

Get a free workflow review

Mission complete. Proof attached.

P.S. Until someone checks, the yes rests on the agent's word that it is done. Bring 1 workflow. On the call, 3 of your own actions get a signed answer from our open-source gate.