安全性是功能，
不是事後補救

One brief pairs the attestation with the discipline behind it — the SOC 2 Type II signature from outside, and our running record of publishing findings against ourselves. Written for a security diligence review. Free to cite, no email gate.

The prospective half of that record: one research cycle run under pre-registered predictions — written before any run, under a no-edit rule — where the first result refuted our own point prediction and the refutation was kept in the permanent record above the recovery. A retrospective claim cannot be diligenced; a method like this can. Free to cite, no email gate.

Everyone is about to have a gate. Almost nobody will have the receipt.

Approval-before-action has stopped being a differentiator and started being platform policy — and the gates are real now, not roadmap. One platform ships a privileged action only when an approval already exists in the session, single-use and expiring in hours. A major CRM’s seasonal release now offers per-message human approval of an agent’s outbound email, configurable three ways: review every message, review only the first, or let a rule decide. Others answered with spend ceilings and after-the-fact session transcripts. A log is written for a reader who was present. A receipt is written for someone who was not — who approved, what they could see when they did, an artifact you can show an auditor six months later. That part isn’t infrastructure. It’s a by-product of operating the work, and it’s what our hash-chain audit trail produces on every engagement. The gate itself is still becoming infrastructure — it just didn’t this month, and we treat that as a reprieve on a schedule, not a reversal.

The gate itself isn’t our answer to oversight, either. Anthropic published the number that ends per-action prompting: users approve 97% of permission prompts. Our agents are instead confined to the reversible half of the work — they gather, draft, propose, and prepare the decision in full, and they never hold the irreversible step. Reversible proceeds; judgment waits. There is nothing to rubber-stamp, because the risky act was never the agent’s to take. And the gate was never a safety mechanism — it is an accountability mechanism: a machine-reviewed action can be perfectly safe and still leave nobody accountable for it. Vendors will keep moving where review defaults sit; who answers for the send doesn’t move with them.

And you don’t have to take our word for the receipt. The schema our records are written to is published. The verifier that checks them is open source and shares zero lines of code with our product — it implements the hash logic from the published spec, not from our source, and proves itself against a golden vector. Even the census of what our audit layer does not yet cover is published, as a number that is only allowed to shrink. A gate is a feature. An attestation a stranger can verify without us in the room is not.

And the boundary between the two halves is not fixed — it moves on evidence. Every proposal an agent makes and every decision a person renders accumulates into a record, and that record is what justifies the next increment of trust: wider drafting authority, longer unattended runs, a new channel. A task tracker can hold shared state; it cannot safely expand what an agent does unwatched. That takes the accumulated record of proposed-versus-decided — produced here as a by-product of operating. Governance isn’t the brake on delegation. It’s what earns the next one.