Verification infrastructure for agentic AI

Proof, not promises.

AI agents now approve payments, change permissions, and touch production systems. Onyx Gate stands between an agent and the systems it reaches: every high‑stakes action is checked against your policies by a deterministic proof engine — and every decision ships with a certificate your auditors can re‑check without trusting the engine, the vendor, or the model.

▶︎  Watch the teaser · 90 s Become a charter partner
decision proved in ~7 ms certificates re-checked offline every rule machine-verified audit trail hash-chained

The gap

A log is not an answer.

Every agent stack can tell you what the model said. Almost none can prove that what the system did was allowed. When a regulator, a customer, or your own board asks “who checked that?” — a transcript of tokens is not evidence. Onyx Gate is the missing evidence layer, in three verbs:

Gate

Decide, fail-closed.

Each consequential action — a tool call, a transaction, a permission change — is decided against your policies: Cedar, Rego, XACML, CEL, or custody-style transaction rules. The verdict isn’t a rules-engine evaluation; it’s a theorem, proved fresh every time. And it has a third answer besides yes and no: a rule can require named approvers to sign first. Drops into any agent stack — as an MCP server, a proxy in front of the tools you already run, or a pre-execution hook.

gate_action wire $250,000 PENDING — 1 of 2 signatures (treasury) DENY — quorum unreachable ⊢ proved · certificate attached

Verify

Interrogate the policy itself.

Onyx Gate answers questions over all requests, not one: can any request matching X ever be permitted? Can a single signer ever move funds? Do a Cedar policy set and its Rego twin agree — in different languages? A violation returns a concrete counterexample; a pass returns a certificate.

assert no-single-signer HOLDS — every case certified cedar × rego: differs witness: mallory → deny vs allow

Attest

Evidence that survives you.

Every decision lands in a hash-chained audit trail — and hands back a signed receipt the holder keeps. Edit, delete, or reorder a record and the chain breaks — loudly. One command re-checks the whole trail offline, months later; the same command answers an auditor’s narrower question and extracts the matching records as a portable bundle.

eg_verify --audit-log trail.jsonl records 1–214 confirmed · linked record 215 chain broken tamper detected

Ninety seconds

Watch the argument.

agent> wire_transfer $250,000 → vendor-payments approved?
agent> grant_role admin → contractor-7 approved?
agent> rotate_keys prod-custody-wallet approved?
agent> …
When it goes wrong, who checked?
action: wire_transfer amount: 250,000 USDC initiator: agent-04 approvals: 1 (2-of-3 required)
DENIED
⊢ proved — required quorum unreachable · fail-closed · milliseconds
PROOF CERTIFICATE · self-contained
premise · the policy set + the request✓
step 1 · the request matches rule 4✓
step 2 · rule 4 requires 2-of-3 approvals✓
step 3 · only one approver has signed✓
conclusion · DENY✓
re-checked by the standalone kernel — offline, no search
#212 gate·allow
chain 9f3a…
⛓
#213 gate·deny
chain 41c7…
⛓
#214 verify·holds
chain de09…
⛓
#215 gate·allow
chain 77b2…
record #213 edited after the fact — chain broken. Caught.
Why? · decision pipeline
Entities · relationship map
Timeline · obligations
The Onyx Foundry
Proof, not promises.
Now selecting design partners.
0:00 / 1:30

Under the hood

Small enough to trust.

Onyx Gate’s architecture is the old, hard discipline of proof engineering applied to a new problem. The searching machinery can be arbitrarily clever, because none of it has to be trusted — only the checker does.

Policies compile to graphs

Policies, claims, and requests compile to one precise graph structure — the same structure your auditors later see drawn as a picture, not a wall of symbols.

The engine proves the verdict

A deterministic engine derives the decision with a fixed set of sound rewrite rules, plus certificate-producing procedures for arithmetic, arrays, bitvectors, and equality.

The proof becomes a certificate

Premise, every rewrite, conclusion — packaged as one self-contained artifact. Nothing about the certificate requires our software’s goodwill to interpret.

A tiny checker re-verifies

Replay, no search. The trusted base is the checker, not the solver — so you don’t trust Onyx Gate’s cleverness, ours, or the model’s. And “anyone can re-run it” is not a figure of speech: the format is published, so anyone can write their own.

The rulebook itself is machine-checked.

Every inference rule Onyx Gate uses is proved sound in two independent, industry-standard proof assistants, and Onyx Gate derivations re-check move-for-move inside both. Not our test suite — kernels we don’t control.

And the format is open, so the claim is falsifiable.

A certificate only means something if someone outside can check it. The certificate format is published as a normative specification under an open licence — written so a checker can be built from it without our source — alongside a conformance suite of valid, invalid, and systematically tampered cases. We then wrote a second checker from that specification alone, sharing no code with the engine, and every build requires the two to agree verdict for verdict on every certificate we have. Don’t want to trust our binary? Don’t run it.

Where it fits

Six places the evidence layer is missing.

Agentic AI governance

Gate the agents you already run.

Onyx Gate ships as an MCP server — or as a proxy in front of the tools your agents already call, so enforcement doesn’t depend on which framework they run. Decisions come back proved and fail-closed, the compliance team gets a tamper-evident trail they can re-verify without asking engineering, and the SOC sees every denial in the SIEM it already runs, each alert carrying the pointer back to the record that proves it.

Digital-asset custody

Prove the policy, not the vibes.

Onyx Gate speaks custody transaction-policy JSON — ordered rules, first match, quorum approvals — and proves properties like “no single signer can ever move funds,” with a certificate per covered case and a concrete witness transaction when the property fails.

Enterprise authorization

Interrogate policy at scale.

For Cedar, Rego, XACML, and CEL estates: safety assertions over all requests, equivalence between an old and a refactored policy set, dead-rule detection — each answer carrying a counterexample or a certificate, never a shrug.

Solver & proof assurance

Audit the provers themselves.

Onyx Gate independently re-derives proofs from cvc5, veriT, E, and Vampire step by step — including the steps the solver itself marked “trust” — so a formal-methods pipeline doesn’t rest on any single tool’s say-so.

Policy migration & drift

Prove the new one matches the old one.

Cedar in the gateway, Rego at the API edge, a legacy XACML PDP, CEL in Kubernetes: nobody runs one policy language, and nothing tells you whether two of them agree. Onyx Gate decides it over a declared vocabulary and reports the exact request they disagree on — or proves there isn’t one. The cutover question, answered instead of eyeballed.

Platform & CI

Catch it in review, not in production.

Policy is code, so verify it where code is checked. A pull request that edits a policy gets its violated rules annotated on the line that caused them, with the counterexample in the message — and a second mode that answers the sharper question: does this change alter a decision? Kubernetes admission policies are read natively, in the language they are already written in.

Measured, not marketed

Numbers we can show you live.

~7 msto decide and prove a policy verdict — measured in-browser, in the live demo, on the real engine compiled to WebAssembly.
19 / 19real cvc5 proofs audited fully verified — including every step the solver itself only marked “trust.”
2independent proof assistants in which every rule is proved sound and derivations re-check — neither of them ours.
1command to re-confirm an entire audit trail offline: every certificate, every chain link, months after the fact.
0disagreements between our checker and a second one written independently from the published format — over every certificate in the repository, re-run on every build.
3independent ways to re-check one decision: our kernel, a program that shares no code with it, and an external proof assistant.

We publish the boundary.

Onyx Gate is a verification and audit reasoner for the decidable, policy-scale fragment — it is not a general-purpose theorem prover, and we say so. A public capability ledger records what it proves, what it declines, and the measured limits. When Onyx Gate can’t decide, it says undetermined — it never guesses.

See it run before you believe it.

A private demo suite runs the real engine in your browser: live policy gating, certified verification, a real audit trail with a tamper caught on screen, and a solver proof re-checked end to end. Ask us for access — it takes ten minutes and no installation.

Charter program

A short list, by design.

We’re selecting design partners: teams with a real audit, verification, or governance problem, who want to shape what gets built and can speak to it when it works.

You getThe engine on your workload, direct access to the founder, and first claim on the verticals we build next.
We askA real problem, honest feedback on a weekly cadence, and a reference when — and only when — it earns one.

Book a call Start the conversation