// StAG · In development · Early access
Structural assurance
for AI agents.
A broker designed to sit at your agent’s tool boundary, turn every proposed action into a deterministic allow, deny, or escalate, and leave a signed record an assessor will accept. Bring your own agent, in any framework. You do not rewrite it.
Agents can act.
Nobody can defend what they did.
Agents open tickets, move money, change access, touch production. Most of them do it unwatched. This is not an awareness gap. Teams know. It is an execution gap: there is no clean way to let an agent act and still defend the action.
Three things nobody deploying an agent can do today.
-
01
Nobody is gating the action.
They are watching it. Detection lives upstream of the action, guesses, and hopes.
-
02
Nobody can reproduce why the agent did what it did.
A non-deterministic model made the call. “Ninety-four percent confident” is not an answer an assessor accepts.
-
03
Nobody can hand an assessor a record they will accept.
The log is mutable, written beside the system, not produced by it. For a team under a mandate that is the reason the agent cannot go to production at all.
There is a gap in the tool landscape.
Everyone is standing on the wrong side of it.
StAG plants its flag on the missing side. The deterministic check that produces the evidence is the same gate that advances the action. You cannot take the action without producing the proof, because the proof-producing step is the control flow, not a logger beside it.
Agent frameworks
Capability. No gate. No evidence.
LangChain, LangGraph, and their kin give the agent capability. Remove the tracing and the agent still runs. Nothing about it can be defended.
Observability
Traces. Passive. Removable.
LangSmith, OpenTelemetry, and the rest give you traces. A trace is not a control. It tells you what the agent did after it did it.
Guardrails
Probabilistic detection.
Prompt filters, low-friction proxies. A regulator does not want probabilistic. They want a decision they can reproduce, from a rule that will fire the same way every time.
What StAG is designed to do.
Four claims. Each defensible to a skeptical engineer.
-
01
Reproducible authorization
The model proposes. A deterministic policy decides. The authorization is reproducible even though the model is not. Not “we are ninety-four percent confident,” but “here is the rule that fired, and it will fire the same way every time.”
-
02
Provenance that drives the decision
StAG tracks where every input came from and refuses to let untrusted data reach a field that authorizes an action. The gate does not judge whether the enrichment was “good,” an unsolvable and dishonest promise. It answers a deterministic question: did untrusted-origin data flow into a field the policy reads?
-
03
Deterministic downstream of the planner
Detection tools sit upstream and guess. StAG sits downstream and bounds. It does not try to detect a bad proposal probabilistically. It makes a bad proposal unable to authorize anything, because the model is never in the decision path.
-
04
Model-agnostic by construction
The assurance lives in the structure around the model, not in the model. The next model does not change the gate. You are not buying a defense tuned to this quarter’s jailbreaks. You are buying a boundary that holds regardless of what runs inside it.
What a signed decision is designed to look like.
Every proposed action becomes a leaf. Verdict from the deterministic policy. Provenance from the origin-bound taint. Signature at the moment the gate decides. An assessor verifies the record against your policy and the signature. Nobody has to trust the producer.
example leaf shape. under design. subject to change through the design-partner program.
stag-decision.leaf
[2026-07-01 09:14:22Z] action.proposed agent: agent://finops/settle-invoice tool: tool://ledger/write input_taint: retrieved(kb:policy-v3) + model(untrusted) verdict: ALLOW rule_fired: policy://finops/settle.rule-14 signed_by: ed25519:a9b4...e3f2 leaf_hash: 0x7d2e91b... [2026-07-01 09:14:29Z] action.proposed agent: agent://ops/scale-fleet tool: tool://k8s/apply input_taint: web(untrusted) → target.replicas verdict: DENY rule_fired: policy://ops/tainted-input.rule-3 signed_by: ed25519:a9b4...e3f2 leaf_hash: 0x3c8a4f2...
What StAG does not do.
Every serious tool has a ceiling. Stating it plainly is the differentiator, not a caveat to bury.
Does not
- Harden the model. StAG is not a jailbreak defense. Adversarial content will still reach the planner; StAG bounds what the planner can authorize downstream.
- Manage identity. StAG consumes the identity claims your platform already issues. It does not replace SPIFFE, IAM, or your workload identity system.
- Claim a release is provably safe. The declassifier makes every crossing legible and inspectable. It does not certify that the crossing was the right call.
- Detect anything probabilistically. StAG does not score prompts, score outputs, or classify intent. That is the guardrails layer.
Design intent
- Single Go binary. Runs in your environment. No source or agent state leaves the boundary.
- Broker at the tool boundary. Bring your agent, in any framework. Route its tool calls through the gate.
- Deterministic policy at the trust path. Model proposes; policy decides; gate emits a signed leaf.
- Signed record per decision. Verifiable against your policy and the signature, without trusting the producer.
StAG is in development. The waitlist below is early access. The design partner program is where the recipe format and integration contract get shaped. The pattern is proven in siblings; StAG-the-product is not yet.
Design partners shape the recipe. Waitlist ships first.
If you have an agent that cannot go to production until you can prove what it does, we want to talk to you. Design partners help shape the recipe format and integration contract, and get first integration support.