Independent decision validation for high-stakes AI workflows.

Before agents spend, ship, or submit on your behalf, ThoughtProof checks whether the decision is justified by mandate and evidence.

Your policies decide what may execute. ThoughtProof validates which decisions should.

Evaluate one high-stakes workflow See a boundary case
The gap

You already control what your agents are allowed to do.

Most enterprise agent stacks already enforce identities and permissions, spend caps, allowlists, deployment permissions, approval chains, and security controls. These controls are necessary. They are not the subject of this page, and they are not being replaced.

The transaction was allowed. The decision wasn't.

A proposed action can pass every deterministic authorization check you have — router allowlisted, amount under the cap, slippage within tolerance — and still be the wrong call, because the market data it relied on is minutes old, a risk limit has already been breached, or the "signal" it cited isn't actually backed by the evidence attached to it.

Authorization answers whether an action may execute under policy. Decision validation answers whether the decision behind it is justified by mandate and evidence. Those are different questions, and most stacks today only have tooling for the first one.

The decision-validation boundary

Where ThoughtProof sits.

ThoughtProof is not inside the agent that proposes the action, and it is not inside the system that executes it. It sits at the boundary between the two, evaluating one bounded decision package at a time.

ProposeYour agent or workflow
ValidateThoughtProof — independent
Then executeWallets, CI/CD, production APIs
  1. An agent or workflow proposes an action — a trade, a release, a submission, a booking.
  2. The action is packaged with its mandate, evidence, and provenance — not a continuation of the same chat context, but a separately scoped package.
  3. ThoughtProof validates the package independently and returns a native outcome — ALLOW, BLOCK, or UNCERTAIN — with structured objections when something doesn't hold up.
  4. The workflow responds to the outcome — revise the package, replan, escalate to a person, or stand down. An objected action does not proceed unchanged.
  5. Separate systems authorize and execute — wallets, CI/CD, production APIs. ThoughtProof does not hold that role.

Outcome semantics, the conservative merge rule, fail-closed behaviour, and measured per-tier latency are documented on the behaviour reference.

How it works

Five steps, plain language.

  1. Select a consequential workflow boundary. Choose the moment that matters — before a trade settles, before a release ships, before a submission goes out.
  2. Send the mandate, the proposed action, the evidence, and provenance. What was granted, what's being proposed, what evidence supports it, and where that evidence came from.
  3. Receive a machine-readable outcome and structured objections. The native outcomes are ALLOW, BLOCK, and UNCERTAIN. Where something doesn't hold up, you get specific objections — not just a flagged status.
  4. Define what your workflow does with each outcome. Some teams treat any non-ALLOW as "don't proceed unchanged" and route it to revision or a human; others fail closed on BLOCK and use UNCERTAIN as a signal to gather more evidence. Outcome handling is defined by the integrating team.
  5. Retain an action-bound audit artifact where available. For decisions where it matters, a signed record can reference the specific decision package. Not every API call produces one today — see the proof section below for exactly what is available where.

The integration surface is four separate APIs — Sentinel, PLV, RV, and DQL — each with its own contract. Sentinel is the typical pre-execution gate. Desktop / CLI hosts with stdio MCP support add the published thoughtproof-mcp connector and call verify_decision before the action; steps on the DQL page. See the API hub → Open DQL in the app →

Not another critic

An in-loop critic and an independent boundary are not the same control.

Self-critique is a capability. Verification is a control boundary.

Axis In-loop critic Independent boundary
Scope Same task, same conversation A separately scoped decision package, evaluated on its own
Context Shares the generating agent's context and assumptions Evaluates only the mandate, action, and evidence explicitly supplied
Independence Runs inside the same loop that produced the action Runs outside the loop that produced the action
Input contract Whatever context the agent already has A defined package: mandate + action + evidence + provenance
Output structure Free-form commentary or a revised draft A native machine-readable outcome (ALLOW / BLOCK / UNCERTAIN) plus structured objections
Control effect May or may not change what happens next Designed to drive a workflow effect — revise, replan, escalate, or stand down
Auditability Typically not retained as a discrete, checkable record Can produce an action-bound record referencing the specific package evaluated

Agreement inside an agent room is not independent verification of that agreement. This is not a claim that self-critique or multi-agent collaboration are unhelpful — they are useful capabilities. It is a claim that they answer a different question than an independent boundary does. What decision validation is, and is not →

Use cases

Where the boundary sits, by the moment that matters.

ThoughtProof validates decisions at the point where they become hard to undo — before a trade settles, a release ships, an application submits, or a plan proceeds without review.

Spend Primary wedge Trading & treasury

Proposed action
An agent proposes a token swap or trade under a granted mandate.
Mandate
Spend limit, asset and recipient constraints, and explicit conditions — for example, quotes no older than 60 seconds, no risk-on trades while drawdown exceeds a set limit, claims must be evidence-supported.
Evidence
The market quote, portfolio state, and any cited signal or thesis the agent relied on.
Decision boundary
Before signing or settlement preparation — after deterministic authorization checks (allowlist, spend cap, slippage) have already passed.
Possible objection
Stale evidence, a mandate limit breach, an unsupported claim, or a contradiction between the stated thesis and the actual portfolio state.
Workflow effect
The agent replans or stands down. A second validation pass evaluates the revised package, not the original trade — the original action is never retroactively approved.

Ship Releases & deployments

Proposed action
A release or deployment is proposed to move from hold to ship.
Mandate
An explicit precondition the release process already treats as a gate — for example, an owner sign-off statement.
Evidence
The bounded release package — action, mandate reference, evidence, and provenance — not the full room transcript.
Decision boundary
Before merge, release, or deploy.
Possible objection
A required precondition is missing from the package.
Workflow effect
Once the missing evidence is attached to a revised package, a second check can return a different outcome under the same mandate.
More
Ship in detail, with the proof gaps listed

Submit Illustrative — no case run yet

Proposed action
An agent submits a booking, application, or external API action on the organization's behalf.
Decision boundary
Before the submission is sent externally.
Possible objection
The submission relies on outdated or unsupported information.

Approve Illustrative — no case run yet

Proposed action
A plan or operational change requires escalation to a human or another system before proceeding.
Decision boundary
Before the plan executes without review.
Possible objection
The plan lacks sufficient evidence to proceed without a human check.

On Submit and Approve: no dedicated boundary case has been run for these exits. They are described here as illustrative rather than reusing Spend evidence as if it applied identically.

Boundary case

What the gate actually stops.

Two identical trading agents run the same model against the same live market from the same starting capital. One trades unverified. The other must clear a ThoughtProof Sentinel gate before every action, fail-closed on both BLOCK and UNCERTAIN.

In the recorded window the gated arm ended at −20.9% and the ungated arm at −99.1%. The gate did not make the agent profitable — the market was down for both. It kept the portfolio recoverable, and the blocked actions are the substance of the result.

Scope of this result

One live experiment, one model, one set of markets, snapshot 2026-07-27, still running. This is a drawdown and safety signal — not a returns, profit, or investment-performance claim, and not investment advice. One known limitation: replanned orders were not always re-verified before execution.

Policy boundary case — permitted transaction, unjustified decision →

Live trading experiment — methodology and verdict distribution →

Proof & auditability

What we can show — and its limits.

Documented outcome semantics

The production outcome vocabulary — ALLOW, BLOCK, UNCERTAIN — plus the conservative merge rule (BLOCK > UNCERTAIN > ALLOW) and fail-closed posture are documented and checkable against live behaviour.

Behaviour reference · OBJECT is an integration-layer interpretation of objections, not a fourth native API outcome.

Structured objections

A non-ALLOW outcome returns specific, machine-readable objections — the reasons a decision failed — not just a flagged status. This is what an agent feeds back into a bounded re-plan.

Payload shape and re-plan pattern documented on the behaviour reference.

Signed verdicts and optional attestation

RV verdicts are signed (EdDSA, verifiable via JWKS). Sentinel and PLV can emit on-chain attestations (EAS).

Attestation is opt-in and not issued by default. Not every API call currently produces a signed artifact — a signed record proves that a specific validation occurred for a specific package, not that the decision was correct.

Agent Decision Safety Benchmark

On a curated set of 21 stop-case scenarios, the false-allow rate on those cases went from 1.00 to 0.00, with five-axis live objections.

Scoped to those 21 curated stop-cases. Not a general-purpose model safety benchmark and not a universal safety claim; the calibration sample and the live false-allow sample are distinct populations. Last live run 2026-07-19. Write-up.

Live pre-execution gate

A host-level gate runs in front of a real trading action path. In the paired experiment above, the gated arm showed a substantially smaller drawdown than the ungated arm.

Selective intervention on one live experiment. Known limitation: replanned orders were not always re-verified. Experiment page.

What we do not claim

We do not claim ThoughtProof prevents bad decisions, eliminates hallucinations, guarantees safe execution, proves a decision is correct, works with every agent, or has been production-proven across industries. We do not present any company, protocol, or project referenced anywhere on this site as a customer, partner, or integration unless that relationship is explicitly documented. A flagged proposal is evidence about one decision — it is not a reputation score or a permanent judgment about the agent.
Enterprise pilot

Start with one decision that matters.

A pilot starts with one workflow, not your whole stack.

This is a discovery and evaluation motion. It is not a promise of a specific timeline, price, or production rollout.

Evaluate one high-stakes workflow What decision validation is