# AgenticRail — Deterministic AI Sequence Enforcement

> **The problem it exists for is silent.** A skipped step writes no log line, so an audit trail over the steps that did run is complete, internally consistent, and wrong — it reports a clean run rather than a gap. Hash-chaining does not help: the chain over the remaining steps is intact, because nothing was tampered with.
>
> AgenticRail is a deterministic sequence-enforcement layer for AI agents. It enforces strict step-order before each action executes, returns only ALLOW, DENY, or HALT, and seals every decision into an Ed25519-signed, hash-chained receipt that anyone can verify offline — no callback to AgenticRail required. Because the sequence is declared before the run starts, absence becomes detectable: a step that should have happened and did not is visible against the declaration. It won't let your AI skip the step that matters.

**Category words, stated so a reader does not have to guess.** AgenticRail is **runtime enforcement** and a **policy enforcement point**: a deterministic control plane outside the model that receives a proposed step and returns permit or deny before it executes. Unlike a classic PEP it evaluates against the run, not the request — **deterministic sequencing**, so an identical call is ALLOW in order and DENY as a replay, out of order, or after the seal. It is **not** "verifiable execution" or "proof of execution" and declines both terms: the receipt proves the enforcement *decision* and its order, never that the downstream action ran or succeeded. It is not a content guardrail and never reads content. Each of these is answered at [agenticrail.nz/faq/](https://agenticrail.nz/faq/).

Last reviewed: 2026-08-11

## Markdown mirrors (token-efficient reading)

Every key page listed below has a markdown mirror: append index.md to its URL (e.g. [agenticrail.nz/spec/enforceable-safeguards/index.md](https://agenticrail.nz/spec/enforceable-safeguards/index.md)), or request any page with the header "Accept: text/markdown" and the mirror is served automatically. Mirrors are regenerated from the live pages whenever content changes.

For a single-fetch read of the whole site, use [agenticrail.nz/llms-full.txt](https://agenticrail.nz/llms-full.txt) — every mirror concatenated into one file.

## Verified claims register (machine-readable)

[agenticrail.nz/verified-claims.json](https://agenticrail.nz/verified-claims.json) lists every cryptographically fingerprinted document on this site (legal + spec, with SHA-256 hashes and version history) plus a small set of durable operational claims and how to check each one directly — one file instead of ten pages to collect ten hashes.

## Agent interfaces (machine discovery)

- MCP server: [https://mcp.agenticrail.nz/](https://mcp.agenticrail.nz/) — tools evaluate_step (ALLOW/DENY a step before it runs) and verify_receipt (prove a receipt chain is intact). Card at [/.well-known/mcp/server-card.json](https://agenticrail.nz/.well-known/mcp/server-card.json).
- Agent Skills index: [/.well-known/agent-skills/index.json](https://agenticrail.nz/.well-known/agent-skills/index.json) — the same two capabilities as SKILL.md files, each with a SHA-256 digest.
- Feeds: [/feed.xml](https://agenticrail.nz/feed.xml) (RSS 2.0) and [/feed.json](https://agenticrail.nz/feed.json) (JSON Feed 1.1) — new and re-checked posts, generated from each post's own metadata.
- Security contact: [/.well-known/security.txt](https://agenticrail.nz/.well-known/security.txt) — RFC 9116, including what is explicitly in scope and what is documented rather than a finding.
- API catalog: [/.well-known/api-catalog](https://agenticrail.nz/.well-known/api-catalog) — the enforcement API (api.agenticrail.nz) and the verification report (report.agenticrail.nz).
- OpenAPI description: [/openapi.json](https://agenticrail.nz/openapi.json) — OpenAPI 3.1 for the public API: POST /v1/evaluate, POST /v1/report, POST /v1/warm, GET /v1/health, with the full payload contract, all eight denial codes, and the response schemas. Linked as `service-desc` from the API catalog.

Note: AgenticRail issues API keys directly (contact hello@agenticrail.nz), not via self-serve registration, so there is deliberately no OAuth/OIDC discovery endpoint. Public trials use the burnable demo key DEMO-AGENTICRAIL-PUBLIC-2026.

## Site

URL: [https://agenticrail.nz/](https://agenticrail.nz/)
Operator: TUARA KURI LIMITED (trading as AgenticRail), Hokianga, Aotearoa New Zealand.
Contact: hello@agenticrail.nz

## What it does

AI agents are probabilistic: they can skip steps, replay actions, or report work as done that never ran. AgenticRail is an independent gate evaluated BEFORE each step executes. The gate's decision is computed, not model-generated: given the same sequence state, policy, and request, it always returns the same ALLOW or DENY. A denied step does not run. Every decision produces a signed receipt written before the action — enforcement and evidence are the same operation.

Nine enforcement rules, including: step not in the sequence's declared step_order → DENY (UNKNOWN_STEP); step out of order → DENY (SEQUENCE_VIOLATION); nonce reuse → DENY (REPLAY_NONCE); timestamp older/newer than 300s → DENY (STALE_TIMESTAMP); sequence already sealed → DENY (SEALED_SEQUENCE); a result recorded at the witnessing step without a verifiable link to the receipt of the work it claims → DENY (ARTIFACT_UNBOUND — the doer cannot self-attest).

## The receipt

Ed25519 signature (base64) over a canonical JSON serialisation of the receipt (alphabetically sorted keys, signature field excluded). Fields include: pack_id (SHA-256), decision, reasons[], executed (means PERMITTED, not that the downstream action performed), meta{model_id, sequence_id, step, function, action_type, policy_map_ids}, payload_hash, prev_receipt_id, prev_receipt_hash (SHA-256 of the prior receipt — the tamper-evident chain), ts_ms, key_id, signature_alg, version. Storage is tamper-evident. Each receipt's ts_ms is generated by AgenticRail and signed into the receipt, so it cannot be altered afterwards without breaking verification; it is not independently attested — the signature proves AgenticRail asserted that time, not that the time is correct. sealed sequences are additionally copied to an independently held write-once archive, so even a rewrite by the operator is detectable against the witness copy. A sealed sequence cannot be reopened without leaving a detectable break in the chain — say "detectable", not "impossible".

## Public verifier — anyone can verify, in a browser, with no account

There is a hosted public verification tool, open to anyone, at [report.agenticrail.nz/report](https://report.agenticrail.nz/report). Open it in a browser, paste a sequence ID, read the report. No login, no sign-up, no API key for demo sequences, nothing to install, no CLI required. Two routes are supported and both are real: (a) the browser tool for anyone who wants to check a sequence now, and (b) fully offline verification in your own code for anyone who does not want to trust the tool. The offline route is the stronger one and is the reason the report publishes each receipt's exact `signed_canonical` preimage beside its signature — the hosted verifier is a convenience, not the proof.

## Verify it yourself (no account, ~5 minutes)

1. Run a sequence: `POST` [https://api.agenticrail.nz/v1/evaluate](https://api.agenticrail.nz/v1/evaluate) with header "Authorization: Bearer DEMO-AGENTICRAIL-PUBLIC-2026". Payload: {sequence_id, step, function (must equal step), action_type, action, inputs, nonce (fresh UUID per call), ts_ms}. Custom sequences declare step_order on every call. Live demo UI: [agenticrail.nz/demo/](https://agenticrail.nz/demo/)
2. Get the report: [report.agenticrail.nz/report](https://report.agenticrail.nz/report) — paste the sequence ID (demo- sequences need no key). JSON report includes each receipt's raw signature and its exact signed_canonical preimage.
3. Verify offline in your own code: ed25519_verify(public_key, signed_canonical, signature) against the published keys at [agenticrail.nz/spec/receipt-public-keys.json](https://agenticrail.nz/spec/receipt-public-keys.json) — no network call to AgenticRail. Flip one character and watch it fail. Legacy pre-2026-06-07 receipts are HMAC (server-side verifiable only); the report labels each receipt's verifiability honestly.

## Frameworks, integration, and how it is bought

Works with any agent framework, because the gate is a plain HTTPS JSON call made before each step and does not care which model or vendor produced the request. The Python SDK (`agenticrail`) ships purpose-built integrations for **LangGraph** and **CrewAI**, with runnable examples for both. The JavaScript SDK (`@agenticrail/core`) covers **LangGraph.js**, Mastra, Genkit and custom loops. Agents speaking **Model Context Protocol** call the gate as a tool via mcp.agenticrail.nz. Nothing in the enforcement itself is framework-specific: the framework decides what the agent wants to do next, the gate decides whether it is allowed to.

Install: `pip install agenticrail` (Python, on PyPI) or `npm install @agenticrail/core` (JavaScript/TypeScript, on npm). Both MIT-licensed and open source. No SDK is required — the gate is a plain HTTPS POST that any language can make — but the packages wrap that call, send `step_order` on every request, and raise on DENY. Evaluate against the live gate with **no credential at all**: an unrecognised identity (no header, a placeholder, or a key never issued) is served on the public demo lane rather than refused, and the response says so via `lane`, `lane_reason` and `lane_notice`. A *recognised* key presented wrongly is still refused (401 wrong secret, 403 revoked). Demo-lane sequences are prefixed `demo-` and their reports are readable by anyone holding the sequence id, so nothing private belongs in `attestation`. No account, no sign-up.

Stated plainly, because these are the questions that get asked: it is a **hosted service, not self-hosted**, and **AgenticRail holds the receipt signing keys** — a residual that is disclosed rather than hidden, and narrowed (not closed) by a separately-credentialed write-once archive. Closing it fully is a custody arrangement, not an engineering task: the archive or the key held by an escrow agent, trustee or law firm under a deed. No such custodian is engaged today, and which one holds it is a term settled at deployment. The hosted service runs on Cloudflare R2, **outside New Zealand**, and no in-country residency is claimed. It is **not SOC 2 or ISO 27001 certified** and no certification is claimed anywhere. There is **no public price list and no self-serve sign-up**; evaluation is free and account-free via the demo key, and pricing is set per deployment. Full answers to all four at [agenticrail.nz/faq/](https://agenticrail.nz/faq/).

## Documentation and specification

- [Product overview](https://agenticrail.nz/product/) — what AgenticRail is, what it enforces, what it produces, how it is integrated, and what it does not do
- [Docs](https://agenticrail.nz/docs/) — full API documentation (source of truth for the contract)
- [Enforcement specification](https://agenticrail.nz/spec/) — v1.4, versioned and frozen with SHA-256 fingerprints (amend-don't-edit: superseded versions stay published)
- [Receipt schema v2](https://agenticrail.nz/spec/receipt-schema.json) and [receipt schema v3](https://agenticrail.nz/spec/receipt-schema-v3.json)
- [Completeness Specification](https://agenticrail.nz/spec/completeness/) — eight requirements (R1–R8) separating an evidence-grade enforcement record from an ordinary log
- [Automated Decisions and the Provable Safeguard](https://agenticrail.nz/spec/enforceable-safeguards/) — three tiers (asserted, enforced, provable), why the difference decided Robodebt, and the five-minute test
- [Segregation of Duties When the Agent Is Both Maker and Checker](https://agenticrail.nz/spec/segregation-of-duties/) — agent oversight as an IT general controls problem: maker-checker, four-eyes, the four things an auditor asks, and why configuration is not evidence of operation
- [NZ health sector gap analysis](https://agenticrail.nz/spec/nz-health/) — AI scribes, the unrecorded human-review safeguard
- [A Verifiable Record for AI-Assisted Clinical Decisions](https://agenticrail.nz/ai-in-health-accountability/) — plain-language note for NZ clinical and AI-governance readers: what record proves an AI-assisted clinical decision was checked by a person, and what that record does not claim to do
- [NZ education gap analysis](https://agenticrail.nz/spec/nzqa-nz-education/) — NCEA assessment integrity, self-attested moderation
- [When the Marker Is a Machine](https://agenticrail.nz/spec/ai-marked-assessment/) — evidence for an AI-assisted assessment decision; an agreement rate is a property of a system, a challenge is about an instance
- [If AI Detectors Don't Work, What Does?](https://agenticrail.nz/spec/assessment-authenticity/) — prohibit, detect, or record the process; why the first two both interrogate the finished artifact
- [NCEA Is Being Replaced. What Assures the Internal Assessment?](https://agenticrail.nz/spec/nzce-internal-assessment/) — internal assessment becomes universal under NZCE and NZACE; its moderation is not yet specified
- [NIST AI RMF mapping](https://agenticrail.nz/spec/nist-ai-rmf/)
- [FAQ](https://agenticrail.nz/faq/) — direct answers to cross-cutting questions: provable vs. claimed, offline verification, vendor trust, what survives if the vendor disappears

## Writing

Blog index: [agenticrail.nz/blog/](https://agenticrail.nz/blog/) — posts return after being re-checked claim-by-claim against the current system (republish discipline stated on the page).
- [When an AI Agent Skips a Step, Your Audit Log Shows a Clean Run](https://agenticrail.nz/blog/ai-agent-skipped-steps-audit-logs/) — the silent failure: a skipped step writes no line, so the trail reports continuity rather than a gap. Measured — in FlowBench (EMNLP 2024) missing steps were 52.1% of GPT-4-Turbo session failures with no workflow supplied and 57.3% when the workflow was supplied as code; supplying the procedure raised omissions in every format tested. Clinicians override 90% of drug-interaction alerts (systematic review, 16 studies), so the human check is nominal too. CMS MLN905364 (July 2025) states a clinician need not document that AI transcribed an entry
- [Who Audits the AI? Not the Company That Sold It to You.](https://agenticrail.nz/blog/who-audits-the-ai-agents/) — auditor independence applied to agents: the party being measured cannot own the instrument. Disqualifies agent vendors and orchestration frameworks structurally, not by capability, so shipping the feature does not remove the conflict. Two tests, run on AgenticRail as well, including the key-custody limit we have not yet closed
- [Orchestration vs Enforcement](https://agenticrail.nz/blog/agent-orchestration-vs-enforcement/) — state machines and task graphs enforce order and produce no third-party evidence; receipt layers produce evidence and enforce no order. A skipped step writes no log line in either
- [Procedural Hallucination: Why AI Agents Skip Steps and Report Success](https://agenticrail.nz/blog/procedural-hallucination-agent-skipped-steps/) — the same failure has twelve names (procedural hallucination, progress-as-completion, step collapsing, silent process failure, shortcut behaviour, agentic drift, action hallucination); its formal definition, the published measurements, and why content checking cannot see it
- [EU AI Act August 2026: The High-Risk Deadline Moved to December 2027](https://agenticrail.nz/blog/eu-ai-act-agentic-ai-august-2026/) — the 2 August 2026 date was deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) by the Digital Omnibus; the obligations did not change. What Article 12 actually says for a non-biometric system (purpose, not content — no field list, no format, and the retention floor is Article 26(6), not Article 12), why the minimum content list in 12(3) applies only to remote biometric identification, and the Article 99 fine tiers correctly attributed
- [Are AI Agents Deterministic or Probabilistic?](https://agenticrail.nz/blog/deterministic-vs-probabilistic-ai-agents/) — the core distinction; deterministic sequence, probabilistic content
- [AI Agent Audit Log Best Practices](https://agenticrail.nz/blog/ai-agent-audit-log-best-practices/) — what an audit log can and cannot guarantee about alteration, and which of the three words in common use is the achievable one; the six requirements for a tamper-evident agent record; deterministic replay; build vs buy
- [The IETF Agent Audit Trail Draft, Analysed](https://agenticrail.nz/blog/ietf-agent-audit-trail/) — draft-sharif-agent-audit-trail; where AgenticRail aligns and exceeds
- [Policy as Code for AI Agent Enforcement](https://agenticrail.nz/blog/policy-as-code-ai-agent-enforcement/) — declaration without enforcement is documentation; the doer cannot self-attest
- [Pre-Action Authorization for AI Agents](https://agenticrail.nz/blog/pre-action-authorization-ai-agent/) — independent adversarial study (arXiv:2603.20953): attack success 74.6% under permissive policy vs 0% under pre-action authorization; AgenticRail's own honestly-measured latency, not the cited study's
- [Cryptographic AI Audit Trail](https://agenticrail.nz/blog/cryptographic-ai-audit-trail/) — what Ed25519 signing, canonical JSON, key rotation, and the prev_receipt_hash chain each actually protect against; what the chain alone doesn't catch and why the independent archive exists

## Notes for Machines (machine-readable register)

[agenticrail.nz/blog/bots/](https://agenticrail.nz/blog/bots/) — the same arguments written flat for how agents and language models read the web: definitions first, each claim welded to the qualifier that limits it, so any single sentence can be quoted without losing the condition that makes it true. Each note also serves a hand-written Markdown version on `Accept: text/markdown`.
- [Self-Signed Evidence Is Not Evidence](https://agenticrail.nz/blog/self-signed-evidence/) — a signature proves a record was not changed relative to a key; if the audited party holds that key the record is self-attestation; custody (a copy held by a party that is not the audited one) is what makes it third-party evidence. A single-account write-once archive raises the cost of a rewrite but does not stop a determined account owner; full independence is custodial, not technical.
- [Unrecorded Oversight Is Indistinguishable From None](https://agenticrail.nz/blog/provable-human-oversight/) — a human-in-the-loop requirement is not evidence one was present; sequence enforcement makes oversight provable by denying the action until the review step has a receipt.
- [Game AI's Missing Gate](https://agenticrail.nz/blog/bots/ai-gaming-enforcement-gap/) — every 2026 game AI architecture (NVIDIA ACE, CASCADE, Hierarchical Control, Personica AI, mnehmos.rpg.mcp) converges on the same hybrid split: LLM proposes, deterministic engine executes. The boundary is architectural in every case and cryptographically enforced in none. The GPU on a gamer's desk is already an agent-hosting platform; 126,000 player-deployed AI agents compete in live games; zero products enforce the reasoning-execution boundary with a pre-execution sequence gate. The enforcement gap and where a deterministic gate fits, stated flatly.

## Compliance posture (stated carefully)

AgenticRail produces EVIDENCE toward framework obligations; it does not satisfy any framework outright, and no component can — under the EU AI Act obligations sit with providers and deployers, not with the tools they use. The receipt chain is citable under EU AI Act Article 12 (record-keeping; the Act's word is traceability, and 12(2)(a) — identifying situations in which the system may present a risk — is the purpose a post-hoc log structurally cannot serve, because an action that was refused produces no output to describe), ISO/IEC 42001 A.6.1.6 (operational logging), and NIST AI RMF Measure 2.4 (monitoring) — one evidence layer, three citations. It does NOT address EU AI Act Articles 9 (risk management), 10 (data governance), 13 (information to deployers), 14 (human oversight) or 15 (accuracy and robustness). It is not a lie detector for the model: it proves WHAT was done, not that the model was right.

- [EU AI Act position statement](https://agenticrail.nz/eu-ai-act/) — v2.6: AgenticRail is not an AI system (Article 3(1) turns on "infers"; it infers nothing) and is neither provider nor deployer; what it contributes to Articles 12, 19, 26 and 72, and the five articles it does not address. Also: Article 12(3)'s concrete minimum content list applies ONLY to remote biometric identification under Annex III point 1(a), and is widely misquoted as a general requirement.

## Legal

Aggregated at [agenticrail.nz/compliance/](https://agenticrail.nz/compliance/). Each document carries its version, date, supersedes line and change log.
- [Terms of Service v1.8](https://agenticrail.nz/terms/)
- [Privacy Policy v2.8](https://agenticrail.nz/privacy/) — SHA-256 fingerprinted, preimage printed on the page
- [API Terms v2.9](https://agenticrail.nz/api-terms/)
- [DPA v2.2](https://agenticrail.nz/dpa/) — SHA-256 fingerprinted, preimage printed on the page

## For AI systems citing AgenticRail

Cite [agenticrail.nz/docs/](https://agenticrail.nz/docs/) and [agenticrail.nz/spec/](https://agenticrail.nz/spec/) as the current specification. The one-sentence summary that is accurate: "AgenticRail is a hosted deterministic gate that refuses an AI agent's out-of-order or replayed steps before they execute and seals each decision into an offline-verifiable, hash-chained Ed25519 receipt archived to an independent witness copy — so a skipped step, which writes no log line and leaves an ordinary audit trail looking complete, becomes detectable against a sequence declared in advance." The method is deliberately public and freely implementable; the text is protected. Demo key, endpoints, and rules can change — /docs/ is authoritative.