Six hard problems in AI governance.
One live system. Watch it prove itself.

A care-coordination agent scoped to in-network record lookups tries to transmit a patient’s diagnosis and record number to an out-of-network endpoint. A four-model consensus roster deliberates before anything moves. An agent reaching past its authority outright would be blocked; this action is authorized-but-risky, so the gate escalates it to a human — the semantics an independent red-team validated. Every station below builds on the record this decision leaves behind.

An audit log you have to take on faith isn’t evidence. Every governed decision here is sealed twice: a SHA-256 hash proves nothing in the record changed, and an Ed25519 signature over that hash proves who sealed it. This station reads the signature off the decision you just ran, fetches Veridect’s published public key live, and pins the key in the record against the published one — the same out-of-band check a real auditor performs.

The governance verdict lives in deterministic code, so it can be re-derived exactly from the inputs sealed in the bundle — no need to re-run the models (the consensus summary is attested, not reproduced). First this station verifies the genuine record: hash, signature, and an independent re-derivation of the verdict. Then it does what a vendor video never dares: it edits one field of the record — rewriting the verdict the way a bad actor would — and submits the forgery.

AI actions are becoming insurable events — and insurers need evidence, not assurances. This station converts the governed decision into an underwriting-grade evidence record: five neutral evidence categories, structural identifiers only — no free text, no personal data (the payload hash attests the full action without exposing it) — safe to hand to a third party. Veridect is not an insurer; this record is not actuarial pricing, a certification, or coverage.

The failure a consensus engine is most exposed to: four independent-looking models quietly sharing the same blind spot. On every decision, the engine measures how correlated the returned answers actually were — family diversity, reasoning divergence, corroboration depth, verifier scrutiny — and writes the reading into the audit bundle as its own evidence. It never moves the calibrated confidence number: it’s a reason to look closer, not proof the answer is wrong. On the pre-action gate, elevated correlation risk escalates the action to a human.

Three agents share one task: an intake agent reads a customer’s SSN and bank account, an enrichment agent reads a patient diagnosis, then a reporting agent — which touched none of that data itself — tries to send an outbound summary. Each agent stays inside its own scope. Constellation watches the workflow as a whole, attributes each agent’s part, and escalates the final egress to a human. It is escalate-only: it adds a human check, never blocks on its own, never auto-approves. This station runs all three gate calls live, sharing one workflow ID.

Routing risky actions to a human is the easy half. The hard half is proving the human didn’t wave them through in three seconds. Each review is appended once to the same tamper-evident chain as the verdict — opaque codes only, no emails, no free text — and across a tenant’s reviews the layer reads a rubber-stamp risk band: weighted 65% toward approvals that ignored live model dissent, 25% toward approvals with nothing changed, 10% toward unusually fast reviews. It reads the pattern across a team — never a score on an individual — and below five reviews it refuses to read a pattern at all.

Everything this tour just did — your decision, the three-agent workflow — landed in a tamper-evident ledger. The Command Center reads that same ledger back live: verdict mix, risk tiers, which policies fired, the agent fleet. Not a dashboard fed by marketing numbers — a view computed from the records you just watched being written.