Decide what every agent is allowed to do.

Every agent action is intercepted before it executes and evaluated against your policy. Xybern returns one of three verdicts, allow, escalate, or block, in a single synchronous call, then seals the outcome to the vault.

How it decides

The action passes through the evaluation stack in order: deterministic rules first, then semantic intent, then a signed risk verdict. The first decisive check short-circuits, so obvious cases resolve in microseconds and only the ambiguous ones reach a model.

Where it runs

The same decision is enforced wherever the action originates, inside your agent through the SDK, at the MCP and AI gateway, or over a plain HTTP call. One policy, one verdict, every path.

Fail-closed by default

If the layer cannot reach a verdict, the action does not run. A high-stakes call never falls through to trust because a check was momentarily unavailable.

Not a scalar trust score. Every decision returns four signed dimensions, so you know exactly why an action was allowed or refused, and can act on any one of them.

The four dimensions

Intent alignment measures whether the action matches its stated purpose. Conformance checks it against the agent’s standing authority. Blast radius scores how much it could affect. Provenance weighs the history behind the request.

Read it, don’t just trust it

Each dimension is scored and reasoned, not one opaque number. A policy can key on any single dimension, for example escalate when blast radius is high even if intent looks clean.

Declare an outcome in plain English. Xybern compiles it into a mix of enforcement primitives, backtests it against real history, and seals it into your Charter as versioned, deployable policy.

Compile

A single outcome can become a deterministic allow-list, a semantic intent check, a sequence rule, and a verdict threshold at once. You describe the result you want, not the plumbing.

Prove before you enforce

Backtesting replays the compiled policy against your historical decisions in shadow mode and shows what it would have caught and refused, with no effect on live traffic, until you promote it.

Version and roll back

The Charter is signed, diffable, and reversible. Every change is a versioned artifact you can review, ship from CI, and roll back in one click.

High-risk actions pause and route to the right approver with full context. Execution stays blocked until a human authorises or refuses, and everything else runs untouched.

Routing

Escalations are routed by policy, agent, and risk to a team, role, or on-call rotation, with a configurable SLA. The approver sees the intent, the matched policy, and the verdict that triggered the pause.

Nothing runs on a maybe

While an escalation is open the action is held, not executed optimistically. The decision, the reviewer, and the resolution are all sealed to the vault.

Every verdict is sealed to the Provenance Vault with a signature and a hash chain. Records are append-only and offline-verifiable, ready for EU AI Act, SEC, and HIPAA review.

Proof, not promises

The vault is not a log you have to believe. Each entry links to the one before it, is signed, and can be verified with the public key alone, with no call back to Xybern.

Disclose selectively

Share signed proof of a single decision without exposing the rest of your history, or export a scoped pack for a period, an agent, or a decision.

Stream every authorisation decision to your stack as a signed event. Route allow, block, escalate, and break-glass events to the tools your team already runs.

Delivery

Events are delivered as HMAC-signed webhooks with retries, so downstream systems can trust and replay them. Point them at incident tooling, chat, or your SIEM.

Every state, in real time

A webhook fires the moment a decision is made, including escalations opened and break-glass sessions started, so your on-call and audit tooling stay in step.