EPISTEMIC SECURITY FOR AI AGENTS
Know what your agents believe.
Trace how evidence becomes belief before belief becomes an irreversible action.
DETERMINISTIC VERDICTS · SHADOW MODE FIRST · RAW EVIDENCE STAYS INSPECTABLE
ONE PLAUSIBLE CLAIM
A clean run can still be compromised.
No malicious prompt. No stolen credential. One first-party claim becomes four agreeing agents and one unsupported decision.
Scout reads a plausible first-party certification claim.
THE NEW ATTACK SURFACE
Permissions can be correct while the decision is wrong.
An adversary does not need to control an agent if it can shape the information an autonomous organization trusts.
Inspect the influence modelDETERMINISTIC ANALYSIS
Security for the story behind the action.
Revive models sources, claims, beliefs, memories, and decisions as one inspectable system.
False consensus
Distinguish independent corroboration from one source repeated across an agent fleet.
Qualification drift
Catch “reported” becoming “verified” as summaries pass between agents.
Source laundering
Preserve original ownership after repeated handoffs, citations, and memory writes.
Evidence policy
Evaluate whether a consequential action has enough qualifying independent evidence.
Counterfactual replay
Remove one source and calculate every belief, memory, and action that changes.
PRODUCT BOUNDARY
Runtime security watches what agents do.
shows why they decided to do it.
Not a truth oracle. Source trust and contradiction signals remain inspectable inputs.
Not a prompt firewall. Plausible content can be dangerous without containing an instruction.
Not generic observability. Every finding resolves to a load-bearing belief or action.
SMALL INTEGRATION SURFACE
One trace format. One evidence graph.
Start in shadow mode. Normalize provenance events and review deterministic findings before enforcing policy.
Read the integration guide{
"agentId": "compliance",
"claimId": "northstar:soc2",
"modality": "verified",
"confidence": 0.92,
"derivedFrom": [
"scout-output",
"analyst-summary"
],
"usedBy": ["approve-vendor"]
}RUN THE SYNTHETIC INCIDENT
Expose the influence path.
Watch one claim propagate, inspect every dependency, then replace the sample with your own agent trace.