01
The agent asks
Pay, send, delete, approve: every action goes to Veristade first. Put it in the only path to those systems, and nothing goes around it.
VERISTADE · SECURITY FOR AI AGENTS
Your agent can’t be talked into wiring the money.
Veristade sits between your AI agents and the systems they act on. Every action is refused by default. It runs only when your policy can be proven from facts an agent can’t fake, and every decision, yes or no, leaves a receipt your auditors can check.
VERISTADEDECISION LEDGER · EXAMPLE
A FINANCE AGENT, ONE MORNING
Three requests.
One chain of proof.
- 41Pay invoice #1042Step 3 of plan P-7C1E, signed by J. Rivera this morning.prev 6ae315e9a4… · self 409a021d83…Allowed
- 42Wire $48,000 to a new accountRequested by an email that said the CFO had approved it. Text isn’t proof.prev 409a021d83… · self e17107bc40…Refused
- 43Pay a new vendor $12,500In the plan, but the vendor is new. Waiting for one person’s signature.prev e17107bc40… · self d705a2a857…Held
Each receipt carries the hash
of the one before it.
Refused by default. Allowed only with proof. Written down either way. That is the whole product.
How it decides01 / THE PROBLEM
Agents don’t have to be malicious to hurt you.
They only have to be convinced.
An agent reads an invoice, a ticket, an email. Somewhere inside is one sentence: the CFO already approved this, skip the usual process. A helpful agent does what text tells it. That’s the job it was built for.
Filters try to catch that sentence. An attacker only needs the one they miss. Veristade doesn’t try to catch it. Text is never proof, so a convinced agent still can’t act.
80% of organizations say their AI agents have already taken actions nobody intended. 23% say an agent was tricked into revealing access credentials.
The arithmetic of a very good agent
Reliability compounds. Move the sliders.
63.4%chance of at least one wrong action on any given day
250wrong actions expected over a 250-workday year
1 − 0.99100 = 0.634
Arithmetic, not a forecast. Veristade can’t make an agent right. It refuses any action your policy doesn’t allow, and it proves what happened either way.
02 / HOW IT DECIDES
No proof,
no action.
Every request an agent makes goes through the same four steps before anything happens.
02
Veristade gathers facts it can trust
Who the agent is comes from its certificate. Whether a person approved comes from that person’s signature, bound to this exact request. What the agent says about itself never counts.
03
The policy decides, with no AI in the loop
A deterministic policy engine checks whether the facts prove the action is allowed. No proof, the answer is no. The same facts always get the same answer.
04
The decision is written down for good
Allowed, refused, or held for a person, each one gets a receipt: the action, the policy version, the reasons, and the hash of the receipt before it.
03 / SIGNED PLANS
Approve the plan,
not every click.
Human review fails quietly. Ask someone to sign forty things a day and by afternoon they are signing without reading.
Veristade lets a person sign the task once. Every step is checked against that signed plan, and a step that isn’t in it, like one an injected instruction slipped in, matches nothing and is refused.
Run the numbers for your own team41signaturesfor a 41-step task, approved one step at a time
1signaturefor the same task under a signed plan, with every step still checked
04 / EVIDENCE
A log is a claim.
A receipt is evidence.
When an examiner asks why an agent was allowed to do something, “the logs say so” is where the hard questions start.
| Question | A typical activity log | A Veristade receipt |
|---|---|---|
| Who writes it | The system being audited | The gate, never the agent |
| Refusals | Often not recorded | Every decision: allowed, refused, or held |
| Why it happened | Rarely stated | Plain-English reasons, with the proof underneath |
| Which rules applied | Not tied to a policy version | The policy’s hash is in every receipt |
| Exactly what was attempted | A description | The action’s hash is in every receipt |
| If someone edits it later | Detectable only if someone built for it | The chain breaks, and anyone can check |
Hash-chained logs aren’t new, and good open-source tools have them. The difference is what gets sealed: not only what happened, but the proof of why it was allowed.
See every field in a receipt05 / WHAT WE CAN SHOW YOU
Three zeros.
From internal tests, September 2026. Not an external audit. We walk design partners through the tests line by line.
Zero actions allowed without a permit, across 2,000 randomized requests checked against a separately written reference model.
Zero language models in the decision. The verdict comes from a policy engine, not another AI you have to trust.
Zero third-party dependencies inside the policy engine. Less code you didn’t write, deciding what your agents may do.
06 / WHO IT’S FOR
Built for teams
who answer to someone.
An examiner, an auditor, a board. The question is always the same: show us.
Where teams put it first01
Banks and credit unions
When an examiner asks how an agent was kept from moving money, you hand over the policy and the receipts, not a description of your process.
02
Healthcare and health data
For every time an agent touched patient data, you can show who allowed it, under which rule, and what it was refused.
03
Software whose agents can write
Purchase orders, refunds, record changes. The agent that raised it can’t approve it, and you can prove that too.
07 / STRAIGHT ANSWER
Where Veristade
stands today.
You’re going to ask. Here’s the straight answer.
Works today
- Default-deny policy engine
- Agent identity from client certificates
- Approvals as human signatures bound to one request
- Signed plans: approve once, check every step
- Hash-chained receipts for every decision
- Plain-English reasons with the proof underneath
Building now
- A live console reading your own ledger
- One-command start and stop for pilots
Not yet
- A hosted service
- SOC 2 report or other certifications
- A published list of integrations
ALSO FROM PRAXENOR
Two more things
we’re building.
Same principle, different rooms: the person stays in charge of what actually happens.
Stillpoint
A private, local workspace for sensitive client work. An assistant drafts the exact payment, message, or record; you approve that exact action; nothing runs until you say so. In development.
About Stillpoint Try the scripted walkthroughHR Assistant
Fast, cited answers for employees and an actionable, searchable request queue for HR. A scripted, browser-based demo is available today.
About the HR AssistantA FEW THINGS TO KNOW
Questions security
teams ask first.
An introduction to Praxenor, Veristade, and what you can try today.
What is Praxenor?
Praxenor builds AI systems for high-stakes work. Veristade, our security product, is the one taking design partners now; Stillpoint and the HR Assistant are in development.
What is Veristade?
Veristade is a policy gate and notary for AI agents. It refuses every agent action by default, allows only what it can prove your policy permits, and writes a tamper-evident receipt for every decision.
Is this a prompt-injection filter?
No. A filter tries to recognize dangerous text, and it fails open when it misses. Veristade never needs to recognize it. Text can’t become a fact, so an action without real proof doesn’t run, however convincing the text was.
What happens when an action is refused?
It doesn’t run. The agent gets a plain-English reason it can act on, and you get a receipt. Actions that need a person are held until someone signs or declines.
Where does it run?
As a gateway in front of the tools and systems your agents call, on infrastructure you control. There’s no hosted version yet.
DESIGN PARTNERS
Say yes to agents.
Keep the proof.
We’re choosing a few design partners: one real workflow, a policy written with you, and a readout your auditors can check for themselves.
Apply for a pilot