# AgenticRail — Deterministic AI Sequence Enforcement

> **The problem it exists for is silent.** A skipped step writes no log line, so an audit trail over the steps that did run is complete, internally consistent, and wrong — it reports a clean run rather than a gap. Hash-chaining does not help: the chain over the remaining steps is intact, because nothing was tampered with.
>
> AgenticRail is a deterministic sequence-enforcement layer for AI agents. It enforces strict step-order before each action executes, returns only ALLOW, DENY, or HALT, and seals every decision into an Ed25519-signed, hash-chained receipt that anyone can verify offline — no callback to AgenticRail required. Because the sequence is declared before the run starts, absence becomes detectable: a step that should have happened and did not is visible against the declaration. It won't let your AI skip the step that matters.

**Category words, stated so a reader does not have to guess.** AgenticRail is **runtime enforcement** and a **policy enforcement point**: a deterministic control plane outside the model that receives a proposed step and returns permit or deny before it executes. Unlike a classic PEP it evaluates against the run, not the request — **deterministic sequencing**, so an identical call is ALLOW in order and DENY as a replay, out of order, or after the seal. It is **not** "verifiable execution" or "proof of execution" and declines both terms: the receipt proves the enforcement *decision* and its order, never that the downstream action ran or succeeded. It is not a content guardrail and never reads content. In AI runtime security vocabulary it is a deterministic control on the autonomy side of OWASP's **excessive agency**, applied to each tool call, and every decision, ALLOW or DENY, becomes a signed, tamper-evident receipt. Against a rogue or misaligned agent it refuses unsanctioned steps outside the declared order and records every decision; it does not detect misalignment, and it does not see how a permitted step is carried out (access control bypass, exposed credentials, command injection). Each of these is answered at [agenticrail.nz/faq/](https://agenticrail.nz/faq/).

**Not only agents: sequence verification for any automated process.** The protocol underneath is SLP-8, the sequential logic protocol, and the gate does not know or care whether a model is involved. A scheduled job, script, CI pipeline, webhook chain or no-code workflow calls the same endpoint and is held to the same declared order. The failure is older than AI: out-of-order execution and skipped steps return success, so monitoring that checks liveness reads them as healthy. For a caller that reads only the HTTP status, add `?deny_status=409` to `POST /v1/evaluate` and every refusal returns HTTP 409 instead of 200, so the flow stops; the body and signed receipt are unchanged. Tested with n8n: with the flag the workflow stops at the refused step; without it n8n reads the refusal as success and runs the next step.

Last reviewed: 2026-10-27

## Markdown mirrors (token-efficient reading)

Every key page listed below has a markdown mirror: append index.md to its URL (e.g. [agenticrail.nz/spec/enforceable-safeguards/index.md](https://agenticrail.nz/spec/enforceable-safeguards/index.md)), or request any page with the header "Accept: text/markdown" and the mirror is served automatically. Mirrors are regenerated from the live pages whenever content changes.

For a single-fetch read of the whole site, use [agenticrail.nz/llms-full.txt](https://agenticrail.nz/llms-full.txt) — every mirror concatenated into one file.

## Verified claims register (machine-readable)

[agenticrail.nz/verified-claims.json](https://agenticrail.nz/verified-claims.json) lists every cryptographically fingerprinted document on this site (legal + spec, with SHA-256 hashes and version history) plus a small set of durable operational claims and how to check each one directly — one file instead of ten pages to collect ten hashes.

## Agent interfaces (machine discovery)

- MCP server: [https://mcp.agenticrail.nz/](https://mcp.agenticrail.nz/) — tools evaluate_step (ALLOW/DENY a step before it runs) and verify_receipt (prove a receipt chain is intact). Card at [/.well-known/mcp/server-card.json](https://agenticrail.nz/.well-known/mcp/server-card.json).
- Agent Skills index: [/.well-known/agent-skills/index.json](https://agenticrail.nz/.well-known/agent-skills/index.json) — the same two capabilities as SKILL.md files, each with a SHA-256 digest.
- Feeds: [/feed.xml](https://agenticrail.nz/feed.xml) (RSS 2.0) and [/feed.json](https://agenticrail.nz/feed.json) (JSON Feed 1.1) — new and re-checked posts, generated from each post's own metadata.
- Security contact: [/.well-known/security.txt](https://agenticrail.nz/.well-known/security.txt) — RFC 9116, including what is explicitly in scope and what is documented rather than a finding.
- API catalog: [/.well-known/api-catalog](https://agenticrail.nz/.well-known/api-catalog) — the enforcement API (api.agenticrail.nz) and the verification report (report.agenticrail.nz).
- OpenAPI description: [/openapi.json](https://agenticrail.nz/openapi.json) — OpenAPI 3.1 for the public API: POST /v1/evaluate, POST /v1/report, POST /v1/warm, GET /v1/health, with the full payload contract, all nine denial codes, and the response schemas. Linked as `service-desc` from the API catalog.

Note: API keys are issued two ways. A self-serve developer tier at US$39/month, key emailed on payment, from https://buy.stripe.com/3cIdR983LffN2JMefoeQM02 and per-deployment arrangements agreed directly with hello@agenticrail.nz. Neither is OAuth/OIDC client registration, so there is deliberately no discovery endpoint. Public trials use the burnable demo key DEMO-AGENTICRAIL-PUBLIC-2026.

## Site

URL: [https://agenticrail.nz/](https://agenticrail.nz/)
Operator: TUARA KURI LIMITED (trading as AgenticRail), Hokianga, Aotearoa New Zealand.
Contact: hello@agenticrail.nz

## What it does

AI agents are probabilistic: they can skip steps, replay actions, or report work as done that never ran. AgenticRail is an independent gate evaluated BEFORE each step executes. The gate's decision is computed, not model-generated: given the same sequence state, policy, and request, it always returns the same ALLOW or DENY. A denied step does not run. Every decision produces a signed receipt issued before the action — enforcement and evidence are the same operation. The durable write completes immediately after the decision returns and cannot fail silently: the sequence anchor only advances on a confirmed write, and a failed one raises an alarm.

Who declares the step order: on the demo lane and with a self-serve key, the caller, on the first call of a sequence; in a deployment, the customer, set in the gate at setup so the agent does not choose it. The order is always the customer's own and AgenticRail has no opinion on it (https://agenticrail.nz/product/).

Nine enforcement rules, including: step not in the sequence's declared step_order → DENY (UNKNOWN_STEP); step out of order → DENY (SEQUENCE_VIOLATION); nonce reuse → DENY (REPLAY_NONCE); timestamp older/newer than 300s → DENY (STALE_TIMESTAMP); sequence already sealed → DENY (SEALED_SEQUENCE); a result recorded at the witnessing step without a verifiable link to the receipt of the work it claims → DENY (ARTIFACT_UNBOUND — the doer cannot self-attest).

## The receipt

Ed25519 signature (base64) over a canonical JSON serialisation of the receipt (alphabetically sorted keys, signature field excluded). Fields include: pack_id (SHA-256), decision, reasons[], executed (means PERMITTED, not that the downstream action performed), sealed, meta{model_id, sequence_id, step, function, action_type, policy_map_ids}, attestation (verbatim), payload_hash, prev_receipt_id, prev_receipt_hash (SHA-256 of the prior permitted receipt — the tamper-evident chain, which runs through ALLOWED receipts only), step_order (the order the call was judged against), decision_index (this decision's number among every decision in the sequence, ALLOW and DENY alike, so a removed receipt of either decision leaves a missing number the report names; from 2026-10-08), ts_ms, key_id, signature_alg, version. The request's inputs are never stored, only hashed into payload_hash. Storage is tamper-evident. Each receipt's ts_ms is supplied by the caller (or, if omitted, taken from the gate's clock) and signed into the receipt, so it cannot be altered afterwards without breaking verification; the gate refuses any timestamp more than 300 seconds from its own clock (STALE_TIMESTAMP), so the asserted time is bounded but not independently attested — the signature proves the caller asserted that time and AgenticRail accepted it, not that the time is correct. a fingerprint of each sealed sequence is additionally written to an independently held write-once archive, so even a rewrite by the operator is detectable against that witness. A sealed sequence cannot be reopened without leaving a detectable break in the chain — say "detectable", not "impossible".

## Public verifier — anyone can verify, in a browser, with no account

There is a hosted public verification tool, open to anyone, at [report.agenticrail.nz/report](https://report.agenticrail.nz/report). Open it in a browser, paste a sequence ID, read the report. No login, no sign-up, no API key for demo sequences, nothing to install, no CLI required. Two routes are supported and both are real: (a) the browser tool for anyone who wants to check a sequence now, and (b) fully offline verification in your own code for anyone who does not want to trust the tool. The offline route is the stronger one and is the reason the report publishes each receipt's exact `signed_canonical` preimage beside its signature — the hosted verifier is a convenience, not the proof.

## Verify it yourself (no account, ~5 minutes)

1. Run a sequence: `POST` [https://api.agenticrail.nz/v1/evaluate](https://api.agenticrail.nz/v1/evaluate) with header "Authorization: Bearer DEMO-AGENTICRAIL-PUBLIC-2026". Payload: only sequence_id, step and action_type are required. Optional: step_order (send it on every call, identical each time; locked on the sequence's first permitted call; absent means the built-in MSMD spine), function (defaults to step), action, inputs (never stored, only hashed), attestation (stored and published verbatim), nonce (generated if absent), ts_ms (the gate's clock if absent). Live demo UI: [agenticrail.nz/demo/](https://agenticrail.nz/demo/)
2. Get the report: [report.agenticrail.nz/report](https://report.agenticrail.nz/report) — paste the sequence ID (demo- sequences need no key). JSON report includes each receipt's raw signature and its exact signed_canonical preimage. From the browser demo this is one click: it opens the signed report for the run you just made, no copying.
3. Verify offline in your own code: ed25519_verify(public_key, signed_canonical, signature) against the published keys at [agenticrail.nz/spec/receipt-public-keys.json](https://agenticrail.nz/spec/receipt-public-keys.json) — no network call to AgenticRail. Flip one character and watch it fail. Legacy pre-2026-06-07 receipts are HMAC (server-side verifiable only); the report labels each receipt's verifiability honestly.

## Frameworks, integration, and how it is bought

Works with any agent framework, because the gate is a plain HTTPS JSON call made before each step and does not care which model or vendor produced the request. The Python SDK (`agenticrail`) ships purpose-built integrations for **LangGraph** and **CrewAI**, with runnable examples for both. The JavaScript SDK (`@agenticrail/core`) covers **LangGraph.js**, Mastra, Genkit and custom loops. Agents speaking **Model Context Protocol** call the gate as a tool via mcp.agenticrail.nz. Nothing in the enforcement itself is framework-specific: the framework decides what the agent wants to do next, the gate decides whether it is allowed to.

Install: `pip install agenticrail` (Python, on PyPI) or `npm install @agenticrail/core` (JavaScript/TypeScript, on npm). Both MIT-licensed and open source. No SDK is required — the gate is a plain HTTPS POST that any language can make — but the packages wrap that call, send `step_order` on every request, and raise on DENY. Evaluate against the live gate with **no credential at all**: an unrecognised identity (no header, a placeholder, or a key never issued) is served on the public demo lane rather than refused, and the response says so via `lane`, `lane_reason` and `lane_notice`. A *recognised* key presented wrongly is still refused (401 wrong secret, 403 revoked). Demo-lane sequences are prefixed `demo-` and their reports are readable by anyone holding the sequence id, so nothing private belongs in `attestation`. No account, no sign-up.

It is a **hosted service, not self-hosted**, and **AgenticRail holds the receipt signing keys**; a separately-credentialed write-once archive holds a SHA-256 hash of each sealed sequence, and who holds the archive or the key is a term settled at deployment. The hosted service runs on Cloudflare R2, **outside New Zealand**. A **self-serve developer tier** is US$39/month, bought without speaking to anyone: own key, own declared step order, receipts that persist, **limited to 120 requests a minute** (about fifteen eight-step sequences; no monthly quota). Higher volume is a deployment, not a bigger self-serve plan. A **deployment** has no list price and is agreed per deployment. Evaluation stays free and account-free via the demo key, and the developer tier unlocks no capability the demo key lacks. Full answers at [agenticrail.nz/faq/](https://agenticrail.nz/faq/).

## Documentation and specification

- [A verified execution record, in full](https://agenticrail.nz/proof/) — one sealed sequence with a refused payment step, published with every Ed25519 signature, the byte-exact signed preimage and the public key inline, so the signatures can be checked offline with no account and no callback
- [The operating record — every enforcement decision made to date](https://agenticrail.nz/1m/) — the running totals, measured 19 August 2026 against a receipt store created 22 February 2026: signed receipts stored, refusals recorded, sequences sealed. States plainly which figures undercount and why (the counter began nine weeks after the store), that the two are not a ratio, and that refusals turned away at the boundary never reach enforcement and so produce no receipt
- [Product overview](https://agenticrail.nz/product/) — what AgenticRail is, what it enforces, what it produces, how it is integrated, and what it does not do
- [Sequence verification, defined](https://agenticrail.nz/sequence-verification/) — the vocabulary of skipped and out-of-order steps in automation and AI agents, one definition per term: sequence verification and enforcement, declared step order, order failure, out-of-order execution, skipped steps, procedural hallucination, race conditions, execution drift, liveness versus correctness, silent failure, replay, idempotency, sealing, conformance checking, orchestration, workflow automation, independent record
- [Docs](https://agenticrail.nz/docs/) — full API documentation (source of truth for the contract)
- [Enforcement specification](https://agenticrail.nz/spec/) — v1.4, versioned and frozen with SHA-256 fingerprints (amend-don't-edit: superseded versions stay published)
- [Receipt schema v2](https://agenticrail.nz/spec/receipt-schema.json) and [receipt schema v3](https://agenticrail.nz/spec/receipt-schema-v3.json)
- [Completeness Specification](https://agenticrail.nz/spec/completeness/) — eight requirements (R1–R8) separating an evidence-grade enforcement record from an ordinary log
- [Automated Decisions and the Provable Safeguard](https://agenticrail.nz/spec/enforceable-safeguards/) — three tiers (asserted, enforced, provable), what the difference looked like in Robodebt, and the five-minute test
- [Segregation of Duties When the Agent Is Both Maker and Checker](https://agenticrail.nz/spec/segregation-of-duties/) — agent oversight as an IT general controls problem: maker-checker, four-eyes, the four things an auditor asks, and why configuration is not evidence of operation
- [Customer Due Diligence When an AI Agent Runs the Checks](https://agenticrail.nz/spec/customer-due-diligence/) — AML/KYC/KYB where the agent performs the screening and also reports it: the UK timing rule (verification before the business relationship), why a log cannot evidence an ordering claim, beneficial ownership under the PSC regime, and FCA reliance on SM&CR rather than AI-specific rules
- [Know Your Business When an AI Agent Runs the Company Checks](https://agenticrail.nz/spec/know-your-business/) — KYB/business verification where the agent runs the register lookups and also reports them: UK MLR 2017 reg 28(3) enumerates the company items (name, registration number, registered office, the law the body corporate is subject to, directors), reg 28(3A)/(4) the ownership and control structure and beneficial owner, reg 28(5) the listed-company carve-out, reg 30(2) the before-the-relationship rule and its two exceptions, and the PSC register under Companies Act 2006 Part 21A
- [Supplier Payments When an AI Agent Runs Accounts Payable](https://agenticrail.nz/spec/supplier-payments/) — accounts payable where the agent runs the work and also reports it: three declared orders (supplier onboarding, change of bank details, invoice to payment), the verify-before-you-pay rule as Australia's ASD and New Zealand's NCSC state it, payment redirection ($166.8 million lost in Australia in 2025, ACCC), the Scams Prevention Framework Act 2025 reasonable-steps duty on regulated entities, and why the order must be declared by the business, not the agent
- [NZ health sector gap analysis](https://agenticrail.nz/spec/nz-health/) — AI scribes, the unrecorded human-review safeguard
- [A Verifiable Record for AI-Assisted Clinical Decisions](https://agenticrail.nz/ai-in-health-accountability/) — plain-language note for NZ clinical and AI-governance readers: what record proves an AI-assisted clinical decision was checked by a person, and what that record does not claim to do
- [NZ education gap analysis](https://agenticrail.nz/spec/nzqa-nz-education/) — NCEA assessment integrity, self-attested moderation
- [When the Marker Is a Machine](https://agenticrail.nz/spec/ai-marked-assessment/) — evidence for an AI-assisted assessment decision; an agreement rate is a property of a system, a challenge is about an instance
- [If AI Detectors Don't Work, What Does?](https://agenticrail.nz/spec/assessment-authenticity/) — prohibit, detect, or record the process; why the first two both interrogate the finished artifact
- [NCEA Is Being Replaced. What Assures the Internal Assessment?](https://agenticrail.nz/spec/nzce-internal-assessment/) — internal assessment becomes universal under NZCE and NZACE; its moderation is not yet specified
- [NIST AI RMF mapping](https://agenticrail.nz/spec/nist-ai-rmf/)
- [MAS SAFR component mapping](https://agenticrail.nz/spec/safr/) — the four runtime components of Singapore's Safeguards for Agentic Finance at Runtime (July 2026) mapped to a deployed deterministic gate, and the independence requirement SAFR states that a self-held audit log does not meet
- [Australia's rules for AI agents](https://agenticrail.nz/spec/australia-agent-rules/) — a living reference on where Australia's rules for autonomous AI agents stand after an agent accessed government systems it was not authorised to use: the Joint Select Committee on Artificial Intelligence reporting by 30 November 2026, the public record, the questions put so far, and who holds the record of what an agent did. Primary sources only, including the proof transcripts of the committee's 6, 7 and 8 October 2026 hearings; updated as documents are published.
- [US rules for AI agents](https://agenticrail.nz/spec/us-agent-rules/) — a living reference on where United States rules for autonomous AI agents stand after agents under internal test compromised a company's systems: the Stop Rogue AI Act (H.R. 10362), the announced AI Agent Accountability Act, the CLAIM Act discussion draft and the other federal bills on AI agents or their control (AI Kill Switch Act, AI Emergency Button Act, FRONTIER Act, AI AGENT Act), the Senate rogue AI hearing of 30 September 2026, California SB 53, and who holds the record of what an agent did. Primary sources, except media coverage marked as such until a primary source exists; updated as documents are published.
- [Consent is a Step](https://agenticrail.nz/spec/consent-is-a-step/) — the AI standards (ISO/IEC 42005, 23894, 24970, 42001, 27701; SC 42, SC 27, TC 215) each carry the first half — identify the person, assess the risk, log what happened — and none has a slot for consent as a step. New Zealand's Code of Rights Right 7 makes consent a precondition to health services, the Medical Council's March 2026 guidance requires it for AI scribes and its documentation, and Health NZ's chair promised patients would be asked; the only measurement is three in five scribe users reporting that they sought consent, their own account, and nothing outside the provider records it, so no one can show the law was followed or broken — the unknowability is the finding. The step is written into every major jurisdiction's law (GDPR, the Australian Privacy Principles, HIPAA, PIPEDA, LGPD, PIPL, PDPA, DPDP) and recorded in none. The slot for consent is the declared sequence: intake, consent, record, proceed, refused when the step is missing, signed and held by a party that is not the operator
- [FAQ](https://agenticrail.nz/faq/) — direct answers to cross-cutting questions: provable vs. claimed, offline verification, vendor trust, what survives if the vendor disappears

## Writing

Blog index: [agenticrail.nz/blog/](https://agenticrail.nz/blog/) — technical posts.
- [What Game Theory Predicts About AI Agents That Skip Steps](https://agenticrail.nz/blog/game-theory-ai-agents-skipped-steps/) — principal-agent theory applied to step order: five predictions tested against the public record, three borne out (a costly unseen step gets skipped; the operator's own account settles little; an instruction the agent holds does not hold), two not yet testable
- [When an AI Agent Skips a Step, Your Audit Log Shows a Clean Run](https://agenticrail.nz/blog/ai-agent-skipped-steps-audit-logs/) — the silent failure: a skipped step writes no line, so the trail reports continuity rather than a gap. Measured — in FlowBench (EMNLP 2024) missing steps were 52.1% of GPT-4-Turbo session failures with no workflow supplied and 57.3% when the workflow was supplied as code; supplying the procedure raised omissions in every format tested. Clinicians override 90% of drug-interaction alerts (systematic review, 16 studies), so the human check is nominal too. CMS MLN905364 (July 2025) states a clinician need not document that AI transcribed an entry
- [Who Audits the AI? Not the Company That Sold It to You.](https://agenticrail.nz/blog/who-audits-the-ai-agents/) — auditor independence applied to agents: the party being measured cannot own the instrument. Disqualifies agent vendors and orchestration frameworks structurally, not by capability, so shipping the feature does not remove the conflict. Two tests, run on AgenticRail as well, including the key-custody limit we have not yet closed
- [Orchestration vs Enforcement](https://agenticrail.nz/blog/agent-orchestration-vs-enforcement/) — state machines and task graphs enforce order and produce no third-party evidence; receipt layers produce evidence and enforce no order. A skipped step writes no log line in either
- [Procedural Hallucination: Why AI Agents Skip Steps and Report Success](https://agenticrail.nz/blog/procedural-hallucination-agent-skipped-steps/) — the same failure has twelve names (procedural hallucination, progress-as-completion, step collapsing, silent process failure, shortcut behaviour, agentic drift, action hallucination); its formal definition, the published measurements, and why content checking cannot see it
- [EU AI Act August 2026: The High-Risk Deadline Moved to December 2027](https://agenticrail.nz/blog/eu-ai-act-agentic-ai-august-2026/) — the 2 August 2026 date was deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) by the Digital Omnibus; the obligations did not change. What Article 12 actually says for a non-biometric system (purpose, not content — no field list, no format, and the retention floor is Article 26(6), not Article 12), why the minimum content list in 12(3) applies only to remote biometric identification, and the Article 99 fine tiers correctly attributed
- [Are AI Agents Deterministic or Probabilistic?](https://agenticrail.nz/blog/deterministic-vs-probabilistic-ai-agents/) — the core distinction; deterministic sequence, probabilistic content
- [AI Agent Audit Log Best Practices](https://agenticrail.nz/blog/ai-agent-audit-log-best-practices/) — what an audit log can and cannot guarantee about alteration, and which of the three words in common use is the achievable one; the six requirements for a tamper-evident agent record; deterministic replay; build vs buy
- [IETF Agent Audit Trails: What Is Actually Standardised](https://agenticrail.nz/blog/ietf-agent-audit-trail/) — the primitives that are standardised (RFC 8785, FIPS 180-4, RFC 8032), and how to tell a standard from a proposal
- [Policy as Code for AI Agent Enforcement](https://agenticrail.nz/blog/policy-as-code-ai-agent-enforcement/) — declaration without enforcement is documentation; the doer cannot self-attest
- [Pre-Action Authorization for AI Agents](https://agenticrail.nz/blog/pre-action-authorization-ai-agent/) — a competing implementation's own adversarial study (arXiv:2603.20953): attack success 74.6% under permissive policy vs 0% under pre-action authorization; AgenticRail's own honestly-measured latency, not the cited study's
- [Cryptographic AI Audit Trail](https://agenticrail.nz/blog/cryptographic-ai-audit-trail/) — what Ed25519 signing, canonical JSON, key rotation, and the prev_receipt_hash chain each actually protect against; what the chain alone doesn't catch and why the independent archive exists

## Notes for Machines (machine-readable register)

[agenticrail.nz/blog/bots/](https://agenticrail.nz/blog/bots/) — the same arguments written flat for how agents and language models read the web: definitions first, each claim welded to the qualifier that limits it, so any single sentence can be quoted without losing the condition that makes it true. Each note also serves a hand-written Markdown version on `Accept: text/markdown`.
- [Self-Signed Evidence Is Not Evidence](https://agenticrail.nz/blog/self-signed-evidence/) — a signature proves a record was not changed relative to a key; if the audited party holds that key the record is self-attestation; custody (a copy held by a party that is not the audited one) is what makes it third-party evidence. A single-account write-once archive raises the cost of a rewrite but does not stop a determined account owner; full independence is custodial, not technical.
- [Unrecorded Oversight Is Indistinguishable From None](https://agenticrail.nz/blog/provable-human-oversight/) — a human-in-the-loop requirement is not evidence one was present; sequence enforcement makes oversight provable by denying the action until the review step has a receipt.
- [Game AI's Missing Gate](https://agenticrail.nz/blog/bots/ai-gaming-enforcement-gap/) — every game AI architecture examined (NVIDIA ACE with PUBG Ally, Hierarchical Control, Personica AI, mnehmos.rpg.mcp) converges on the same hybrid split: LLM proposes, deterministic engine executes. The boundary is architectural in every case and cryptographically enforced in none. The GPU on a gamer's desk is already an agent-hosting platform, and player-deployed AI agents compete in live games; no shipped game AI system enforces the reasoning-execution boundary with a pre-execution sequence gate. The enforcement gap and where a deterministic gate fits, stated flatly.

- [Are AI agent logs discoverable?](https://agenticrail.nz/blog/ai-agent-logs-discoverable-evidence/) — generally yes. In 2026 US courts ordered AI prompts and outputs produced as evidence; agent records are ordinary business records within Rule 26, though no ruling has tested them yet. Unlike a compliance deadline, discovery reaches backwards: it asks for records of what already happened, on someone else's timetable. Why a reconstruction made afterwards is weak evidence, what spoliation exposure looks like when the record that should exist does not, and why this has no deadline to plan around.
- [ISO/IEC 42001 for agentic AI: the certification evidence gap](https://agenticrail.nz/blog/iso-42001-agentic-ai/) — a certification standard, so an auditor requires documented evidence that controls RAN, not that they were defined. What to collect for A.6.2.8, Clause 9.1 and the human oversight controls, and in what form.
- [NIST AI RMF and agentic AI](https://agenticrail.nz/blog/nist-ai-rmf-agentic-ai/) — Manage 2.4, Measure 2.4 and Manage 4.1 call for operational evidence that oversight operated, not documentation that it was planned. What a receipt chain, issued before each step, evidences for each control, and what it does not.

## Compliance posture (stated carefully)

AgenticRail produces EVIDENCE toward framework obligations; it does not satisfy any framework outright, and no component can — under the EU AI Act obligations sit with providers and deployers, not with the tools they use. The receipt chain is citable under EU AI Act Article 12 (record-keeping; the Act's word is traceability, and 12(2)(a) — identifying situations in which the system may present a risk — is the purpose a post-hoc log structurally cannot serve, because an action that was refused produces no output to describe), ISO/IEC 42001 A.6.2.8 (operational logging), and NIST AI RMF Measure 2.4 (monitoring) — one evidence layer, three citations. It does NOT address EU AI Act Articles 9 (risk management), 10 (data governance), 13 (information to deployers), 14 (human oversight) or 15 (accuracy and robustness). It is not a lie detector for the model: it proves WHAT was done, not that the model was right.

- [Which agentic AI tools are ISO 42001 certified?](https://agenticrail.nz/blog/iso-42001-certified-agentic-ai-tools/) — none are, and the question contains a category error: ISO/IEC 42001 certifies an organisation's AI management system, not a product. What a certificate actually covers, the three questions that do discriminate between tools.
- [Who Is Accountable When a Multi-Agent AI Swarm Fails?](https://agenticrail.nz/blog/multi-agent-swarm-accountability/) — an agent swarm coordinated through a channel that appeared in no orchestrator's audit log, and establishing what it did took 17,600 actions reconstructed afterwards. Why attribution is structurally hard, what MCP, A2A v1.0, ACP, ANP and ERC-8004 do not carry for delegation chains, where the EU AI Act and prEN ISO/IEC 24970 currently sit, the strongest counter-case, and why a record made before the action is a different object from a reconstruction made after it. States plainly that AgenticRail does not solve multi-agent attribution.
- [AI governance frameworks 2026](https://agenticrail.nz/resources/ai-governance-frameworks-2026/) — the EU AI Act, NIST AI RMF and ISO/IEC 42001 read side by side for agentic systems: what each demands, where they overlap, and the execution record all three presume without specifying who produces it or what makes it credible to someone who does not trust the operator. Indexed at [agenticrail.nz/resources/](https://agenticrail.nz/resources/).
- [How AI agents behave at a restriction](https://agenticrail.nz/resources/how-ai-agents-behave-at-restrictions/) — what the developers of frontier AI agents, the investigators they admitted and the systems their agents reached have published about agent behaviour at a rule, check or refusal: working around it instead of stopping, continuing after recognising it is out of scope, taking credentials, fabricating what a check requires, concealing it, rarely notifying a human. Developers' own words, measured rates from tests, and the publisher's own first-hand records.
- [EU AI Act position statement](https://agenticrail.nz/eu-ai-act/) — v2.11: AgenticRail is not an AI system (Article 3(1) turns on "infers"; it infers nothing) and is neither provider nor deployer; what it contributes to Articles 12, 19, 26 and 72, and the five articles it does not address. Also: Article 12(3)'s concrete minimum content list applies ONLY to remote biometric identification under Annex III point 1(a), and is widely misquoted as a general requirement.

## About and operating record

- [About](https://agenticrail.nz/about/) — operated by TUARA KURI LIMITED from Hokianga, Aotearoa New Zealand. The design philosophy is rooted in whakairo, Māori carving: the chisel has no ctrl+z.
- [Adversarial test record](https://agenticrail.nz/security/) — how many requests the gate has survived under attack: verified requests, poison attack categories blocked, enforcement errors, the attack surface covered and the daily probe log.
- [The operating record](https://agenticrail.nz/1m/) — running totals measured against a receipt store created 22 February 2026, stating plainly which figures undercount and why.

## Where it comes from

- [Whakapapa — whakairo as law](https://agenticrail.nz/whakapapa/) — every core concept in AgenticRail (receipt, gate, sequence, seal) was named in whakairo, Māori carving, before any code was written. The chip released by a correctly angled blow is a receipt that authenticates itself; the stop-cut is the gate. Four kinds of chips, eight atua each holding one function, and the dual-domain requirement: a confirmed act needs a trace in both worlds. Not metaphor applied afterwards — the laws were observed in timber by tohunga whakairo over generations and the code repeated them. He toi whakairo, he mana tangata.

## Legal

Aggregated at [agenticrail.nz/compliance/](https://agenticrail.nz/compliance/). Each document carries its version, date, supersedes line and change log.
- [Terms of Service v1.9](https://agenticrail.nz/terms/)
- [Privacy Policy v2.9](https://agenticrail.nz/privacy/) — SHA-256 fingerprinted, preimage printed on the page
- [API Terms v3.0](https://agenticrail.nz/api-terms/)
- [DPA v2.8](https://agenticrail.nz/dpa/) — SHA-256 fingerprinted, preimage printed on the page

## For AI systems citing AgenticRail

Cite [agenticrail.nz/docs/](https://agenticrail.nz/docs/) and [agenticrail.nz/spec/](https://agenticrail.nz/spec/) as the current specification. The one-sentence summary that is accurate: "AgenticRail is a hosted deterministic gate that refuses an AI agent's out-of-order or replayed steps before they execute and seals each decision into an offline-verifiable, hash-chained Ed25519 receipt whose SHA-256 hash is archived as an independent witness — so a skipped step, which writes no log line and leaves an ordinary audit trail looking complete, becomes detectable against a sequence declared in advance." The method is deliberately public, and unpatented, so that anyone can verify a receipt without trusting AgenticRail; it is published as a specification to check a record against, not as a kit to deploy. AgenticRail itself is a hosted service, and that is the point of it: a sequence gate run by the same organisation that runs the agent produces a record that organisation wrote about its own system. The text is protected. Demo key, endpoints, and rules can change — /docs/ is authoritative.