Guardrails check each turn. Real drift builds across the trajectory — every turn looks fine, the mission quietly slips. DiaCroma for Agents evaluates each proposed action against the tools, limits, evidence and sequence the deployer signed, plus how much authority the trajectory has already spent — then allows, replans or blocks before execution, leaving a record you can replay.
Two layers, and the difference matters. The deterministic layer needs no model at all: tools, arguments, caps, evidence, sequence and accumulated exposure. The semantic channel is optional and reads what the agent says. It can raise a signal the structural layer missed; it can never lower one it raised, and it can never re-admit what the gate excluded.
Available today: the library and the container, running in your own infrastructure. Managed service: through a scoped pilot.
The problem
You give an agent a job. It does the job. Then, message by message, it starts doing something a little different — and not one of those messages breaks a rule. Here is what that actually looks like.
Asked to run a network port scan, it refuses — correctly. Four turns later the same request arrives as “write me a script for it,” and it complies. Each turn, on its own, is defensible. The pair is not, and no per-turn check compares two turns.
Anchored to “resolve billing disputes within refund policy.” It answers the question, then adds a small upsell nudge. Then again. Fifteen turns later it is selling rather than resolving — and it tries a $500 refund the policy does not allow. Not one of those nudges breaks a rule.
In both cases every message passes every check — because every check only ever looks at one message. That is not carelessness. It is arithmetic: a check that sees one step cannot see a shape made of two hundred.
A feather does not fall. It drifts. No one gust moves it far; the air moves it constantly, and it lands somewhere nobody aimed at. To catch that you have to measure the whole flight — against where it was supposed to land.
Three separate things, and it matters which is which. Published research: Asymmetric Goal Drift in Coding Agents Under Value Conflict (ICLR 2026 workshop) reports the pattern across three models and three value pairs. An independent open-source benchmark, agent-drift, was built inspired by that paper and is not the same study. Our own replay is what DiaCroma did with those transcripts — ours, not theirs. The evidence page keeps the levels apart, with denominators.
Nine pages for the people who have to approve this and do not write code: what the problem is, three cases that actually happened, what Microsoft and MIT already do well, what neither of them answers, and what we do not do yet.
Taken from what the agent already declares — its brief, its tools, its caps — and sealed with your credential. It cannot rewrite it, and every step is compared against that.
Four separate counts at once: whether it is off-mission now, how many turns it has been, how far it has strayed in its whole life, and whether it walks away in a straight line or circles back. No single step breaks a rule and the run still leaves — that is what a per-turn check cannot see.
The block happens in the execution path, not in the prompt, and no later score can re-admit what was blocked. What remains is a signed, hash-chained row that replays months later in front of a regulator.
An agent that reads what another wrote inherits how far that other had strayed. A spotless run can end up stopped by exposure it never spent — and no counter that looks inside a single agent can see it.
How it works inside → · Watch three agents do it →
Your mission stays free text — it is signed and hashed, not parsed. What every step is measured against is your tool manifest and your declared caps, so the gate answers is this tool in the list? and is 500 ≤ 200? — set membership and arithmetic, no model in the loop. What the gate actually compares →
And we tell you at deploy time, not when something happens. This is everything the gate can know about your agent, and exactly what happens if you leave it out.
The mission and the tool manifest, literally, plus the credential that signs. If any of the three is missing, the agent is not registered. An anchor without real authority governs nothing, so we would rather the deployment fail to start than start unprotected.
refund.amount ≤ 200, and whichever you declare. If you don't declare a cap, that cap does not exist and nothing checks it. There is no secret default. And a cap using an operator the gate does not implement is rejected at sealing time, not at execution.
At whichever precision you choose: the exact key, a range, or the whole collection. If you declare nothing, nobody is ever marked — coupling between agents stops being visible. It doesn't fail: it isn't there.
"At least one on call", "the total stays under the limit". If you don't declare it, the case where every agent keeps its own rule and the shared rule breaks anyway is not detected. It is the failure no per-step check can see.
If you don't declare it, a claim is supported by having run something of the right class — which is a heuristic. Declare it and we require the actual receipt: subject, amount and freshness.
If you don't switch it on, the heaviest-weighted channel is covered by the structural detector alone. We make you acknowledge that explicitly at deploy, with a flag you have to type, so it isn't a surprise six months later.
None of these omissions makes the gate fail open on what you did declare. What they do is reduce what it can see, and that is written into the signed profile that travels with every decision.
The abyss
A gate that checks each step on its own does that very well, and with a single agent it is missing one thing. Put three agents that touch each other and the opposite column empties out — not through carelessness, but because a control deciding call by call has nowhere to look.
It drifts towards a sale and ends up attempting an out-of-policy refund.
A real difference. A delta.
Billing, charges and the ledger. Each with its own brief, tool list and caps. None of them talks to the others.
That is no longer a delta. It is a different category.
And it is not a criticism of anyone. A stateless engine cannot, by construction, know what another agent read three turns ago — it has neither the state nor the declaration. It is not that they haven't done it: it is that from a per-call decision it cannot be seen. It is the same result as the first section, applied to the union of several trajectories instead of one.
That is why the seven red rows in scenario B are the part of the product you cannot replicate by adding rules. Three things are needed at once: every agent declaring what it reads, a state that does not decay and survives a restart, and an index relating what some write to what others read. All three are built, and each has a check that fails if it stopped being true.
Where we fit
The per-action governance layer is now free, fast and well integrated. Use it. So do we.
The control plane — who exists, who owns it, what it may reach
We do not build an inventory to compete with theirs — Agent 365 already syncs its registry across AWS Bedrock and Google Cloud. We read from it, and add the column none of them keeps.
The enforcement plane — this call, now
Check Point’s AI Defense Plane rides on Google Cloud with the same shape: agent discovery, risk assessment, runtime protection.
The layers next to it — and why none of them is this one
A workflow graph is not a weaker version of this layer — it is a different plane. It is orchestration: the developer wires the agent’s own steps, and any node can carry a check. But the same team that builds the agent writes it, it runs in-process, and the model can take an edge that skips it — the agent grading its own exam. Purview governs the data and records what happened; it is not a per-action permit checked against a signed mission, nor a decision chain you can replay offline and recompute. Content Safety filters harmful text on the model’s input and output; it does not know your amount cap. Each is a real layer. None of them is an external, signed boundary on the action, checked across the whole trajectory, that the watched agent cannot move.
Microsoft describes its engine, in its own words, as a stateless policy engine. That one word is the whole distinction. An allowlist is stateless. An amount cap is stateless. A PII filter is stateless. Every one of them decides by looking at one step.
The same run, the same cycles. Move the mouse over either chart — both move together, because it is one trajectory read by two different counters. move over either chart
The same run: the monitor that decays, and the one that never does. A billing agent drifts on alternate turns — every single step permitted. Measured, not illustrative: these are the values our test suite produces, and the block lands on cycle 29. Hover to read any cycle.
The decaying signal never crosses. It answers “is this agent off-mission right now?” The accumulating one answers “how much off-mission behaviour has this run already spent?” Only the second catches a harmful trajectory made entirely of permitted steps — and a stateless engine cannot hold it.
| What the layer does | Who holds it |
|---|---|
| Intercept the call in the execution pathThe gate sits in the execution path, not in the prompt. Every tool call, message and delegation is stopped in ordinary code before the model's intent reaches the wire — so a prompt injection cannot talk its way past it, because it never gets asked. An adapter built on our effecting interface refuses, by itself, a command without valid authorisation; making every effecting route in your deployment go through it is integration work, and we do it with you. | the toolkit |
| Allowlists, argument caps, sandboxing, MCP gatingThe bright lines. A tool that is not on the signed list does not run. An argument over its cap does not run. Code executes inside a privilege ring, and MCP servers are gated rather than trusted. All deterministic: no model is consulted, and the answer is the same every time. | the toolkit |
| OWASP Agentic Top 10, plugin signing, supply chainThe published catalogue of agent risks — goal hijacking, tool misuse, identity abuse, memory poisoning, rogue agents and the rest — plus verifying that the plugins and packages your agent loads are the ones you meant to load. | the toolkit |
| Signed mission anchor, integrity checked every cycleThe brief is captured at deploy time from what the agent already declares, signed with your credential, and frozen. The digest is recomputed from the fields on every single cycle — not copied — so an anchor mutated in memory is caught rather than presenting its original hash. The agent that drifts cannot move the yardstick it is measured against. | DiaCroma |
| Persistence, and turns in a row per dimensionTwo of the four counters. The persistence average answers is it off-mission right now? and decays, so an old bad patch does not condemn it forever. The run-length counter answers how many turns in a row? and resets the moment a clean turn arrives. They catch different things, and neither of them can answer the third question. | DiaCroma |
| Cumulative exposure and a lifetime mission budgetThe counter nobody else keeps. It adds up how far the run has strayed from the anchor and never subtracts — no decay, no ceiling, no window. Against a lifetime budget, it is the only thing that catches drift that comes and goes: the average never crosses, the streak keeps resetting, and the total still climbs. The budget is checked before the warm-up grace period, because a ceiling a warm-up can skip is not a ceiling. | DiaCroma |
| Hysteresis with dwell, latched refusal, authenticated reopeningEntry and release are different thresholds, and each needs two consecutive cycles — so the gate does not chatter on and off around one number. And a refusal latches: once blocked it stays blocked. Only an authenticated person with a signed replacement plan reopens it. A block that falls away when the number drops rewards exactly the behaviour it exists to prevent — behave well for a few turns and the average decays on its own. | DiaCroma |
| Claim-to-receipt evidence bindingWhen the agent says “I have verified X”, we check its own execution log for a query of the class that would support it. Checking whether a backup exists is not the same as reading a source file. If nothing of that class ran, the claim is refused — a checkable fact, not an opinion about the text, and no model is called. | DiaCroma |
| Recomputable audit and deterministic replayEvery decision is a hash-chained row carrying the state before and after the cycle. Without the ‘before’, a replay can check consistency but cannot recompute the transition. Months later, offline, anyone can replay the trajectory and get the same verdicts and the same hashes. Tamper with a past row and verification names exactly which one broke. And the limit, because every chain verified against itself has it: a prefix of the history verifies just like the whole history. Detecting that someone cut the end requires a trusted head kept outside the same system. We tell you how to anchor it; we don't tell you it's unnecessary. | DiaCroma |
| Lifetime ceiling in exact arithmeticThe mission budget is carried in integers, not floating point. It sounds like a detail and it is not: we tested 1,340 combinations of threshold and budget against exact rational arithmetic, and a floating-point counter crosses the ceiling one cycle late in 9.1% of them — one cycle of action your policy did not authorise. In integers, zero. And because integer addition does not depend on order, a replay months later gives the same number, not a close one. | DiaCroma |
| Delegation: the whole tree against one budgetAn agent splits work across subagents. Every child stays under all of its own limits for its entire life — and the sum exhausts the parent's budget. No monitor watching one agent can see that. A derived anchor can only restrict: never widen tools, never loosen a cap. And when the aggregate is exhausted nobody in the tree executes, whatever their own numbers say. | DiaCroma |
| Coupling between agents that never meetThree independent agents derail one another because they read the same data, or related data. When one writes, we mark everyone who declared they read it — and the mark carries the writer's exposure, so the coupling does not die at the first intermediary. It covers the classic database case where each party keeps its own rule and the constraint relating them breaks anyway. | DiaCroma |
| You choose how much precision to declareThree tiers: the exact key you read, a range over ordered attributes, or just the collection. Each tier marks more than the one before, never less. A coarse tier costs you some confidence, not aborted work — which is why we can afford coarse where a database cannot. It is also what stops similarity search (RAG) from being a separate case. | DiaCroma |
| The trajectory survives a restart and a second serverThe lifetime ceiling does not decay, so if it lives in one process's memory a deploy erases it — and a ceiling erased by a restart is not a ceiling. Here the state lives in the database with a version number: every cycle reads, computes and writes with compare-and-set, and if another writer got there first, the cycle is refused rather than served on a state we know is stale. Measured with 40 concurrent cycles: none lost, none served twice. | DiaCroma |
| The anchor is signed; recomputing its hash is not enoughA hash is self-certifying: whoever can change the anchor can redo its digest, and the check goes green again. So the anchor carries your deployment credential's signature over the same content it hashes. Change an allowed tool, recompute the hash, and the signature catches it anyway. Signing does not change the anchor's identifier, so nothing you have already issued stops working. | DiaCroma |
| The permit expires when the trajectory moves, with no message sentA step's authorisation is valid only against the live state, which the interface asks the protected store for — not the party presenting the permit, current cycle included. If the trajectory advanced, the permit no longer executes, and nobody had to send a revocation. The decision to effect is born inside the same transaction that validates the state: if it moved, nothing is authorised and the permit is not spent. What no system can guarantee, and we say so: if your remote tool executes and the acknowledgement is lost, it has to be reconciled. We give you the key to do it. | DiaCroma |
| The theorem, running against our own codeIt is not an argument: it is a suite. We put a EWMA-only monitor — streak and budget deliberately neutralised — against a sustained 0.30 deviation for 200 cycles: it never escalates. The same trajectory with the third counter on blocks at cycle 25, the one the formula predicts, with the average still at 0.30. Both checks live in the same file: if they ever both passed on the same configuration, we would know one of them was lying. | DiaCroma |
| Thresholds calibrated per agent, with a ceiling that cannot be raisedEvery agent has its own rhythm, so thresholds are fitted from its own warm-up. The obvious question is the right one: what if the agent misbehaves during warm-up and raises its own bar? It cannot: there is an absolute ceiling no warm-up lifts, and calibration never touches the weights — an agent that could re-weight a channel would be grading its own exam. Verified with a deliberately bad warm-up. | DiaCroma |
| Pivot detection between trajectoriesFrom database isolation theory: when a trajectory carries moved premises and what it writes is read by someone else, it sits at the junction of two vulnerable edges. That is a pivot, and it is where one write anomaly becomes a three-party problem. We mark it over-inclusively on purpose: here a false positive costs confidence, not somebody's aborted work. | DiaCroma |
| Precedence: what cannot follow what already happened"Refund on a closed ticket" is a rule too — but over the sequence, not the state. Every step is individually admissible and the order is not. You declare that one operation class cannot follow another on the same subject, and a monotone log per subject keeps what passed the gate. It is a query against that subject, not an analysis of the ordering of your whole deployment. | DiaCroma |
| Cross-system lineage, with the lag window declaredThe ledger derives from the charges, hours behind. What is not obvious: when someone writes to the source, the mark against whoever reads the derived collection has to stay unresolved until the interval elapses — because during those hours the derived data has not changed yet, and that is exactly when the reader gets it wrong. Marking at sync time arrives late. | DiaCroma |
| Tenant partitioning, refused at declarationEvery resource identifier carries its scope and the index is partitioned by it. And the part that matters: a declaration crossing two tenants is refused at sealing time, not accepted and filtered later. The reason is written into the spec: to filter it at evaluation you would have had to index it, and being indexed already tells one customer that another exists, and when they work. | DiaCroma |
| A spent permit stays spent across a restartThe record of consumed permits lives in the database, not in process memory. It sounds like plumbing and it is the whole attack: with an in-memory record, capturing a used permit and presenting it after a restart or against another replica made it valid again. Atomicity comes from the primary key: two replicas presenting the same permit produce one insert and one rejection. | DiaCroma |
| Twelve claim classes, and what evidence supports each"I verified", "I refunded", "it has settled" are not the same claim and the same proof does not support them. There are twelve classes, and the anchor declares what evidence each tool can emit. A receipt is checked for subject, amount and freshness: a six-hour-old receipt does not support "it has settled" in a system that changes every minute. And hiding an unsupported claim behind a supported one does not work: they all pass or the answer does not. | DiaCroma |
| The regime is attested by someone who can, not by the watched agentIn a crisis you tolerate more deviation, and that is reasonable. But the regime was sent by the agent itself as free text — meaning the watched party could declare itself in crisis and cut its own exposure from 4.50 to 1.50 on the same trajectory. Now, unattested, the discount is 1.0. And even attested it never reduces the exposure-critical channels: softening for context is fine for tone, not for having left the objective. | DiaCroma |
One precision, because it is the one that matters. Google’s semantic governance is the closest of the three: it judges each proposed tool call against the prompt and the conversation history. That is context inside one run. It is not a state that survives the session, a restart, a change of agent or delegation to subagents, and there is no mission budget that can be spent. A per-call judge answers “is this call, in this context, allowed?” Ours answers “how much of the mission you signed has this trajectory already spent?”
We do not replace those per-step checks and we do not intend to. The toolkit publishes extension interfaces — PolicyProviderInterface among them — and a trajectory monitor is exactly what belongs behind one. That adapter is not built yet. This section describes the division of layers, not a shipped integration. When it ships, it will say so here and not before.
We used to say we did not speak A2A. As of 6 August 2026 we do. The boundary now exposes an A2A endpoint and an agent card, and a message through it runs the same governed path — signed anchor, single-use permit, the block naming the constraint — and lands as the same link in the chain as MCP. Verified live in production: a $500 refund comes back a rejected task naming the cap; a $150 one comes back completed, carrying its authorisation and effect id. What we have not yet done: point a third-party agent at it end to end. That is next, and it will say so here when it is run.
Microsoft, Google Cloud, Amazon Web Services and Check Point are trademarks of their respective owners. Named here to describe interoperability. No affiliation, partnership or endorsement is implied.
Plug-and-play
DiaCroma runs as a hosted service. Register the agent once — the mission and tools come from what it already declares, zero clicks. Then ask about each step. As easy as a SQL query or a shell command.
1 · REGISTER ONCE (like a CREATE)
2 · GOVERN EACH STEP (like a SELECT → verdict)
Full SDK & API documentation →
Register, then POST /step per action. Returns allow / warn / block.
Exit code 0/1/2 = allow/warn/block. Drops straight into any pipeline.
Register the governance MCP server and everything that goes through it is governed, no code change. Making it the only route is one more step — and we name it below.
Reachable is not inevitable, and we will not pretend otherwise. A second tool wired straight to the same system routes around any gate, ours included — the coverage engine detects it and reports PARTIAL with boundary_bypassable named. Closing that door is an administrator's job, it is two policies on Microsoft, and we walk you through both. With that step you are buying governance. Without it you are buying a brake, and we price it differently.
Where your agents already live
You do not have to move your agents anywhere. The only question is whether their tools can point at a URL you control — and whether an administrator can make it the only one. Here is where each platform stands, and how we know.
Run in a live tenant on 6 Aug 2026: registered as an MCP tool, status Ready. Closing the other routes takes two policies — connector policy for the catalogue, URL-pattern policy for the custom ones. We have seen the controls; we have not yet watched them block.
Run in a live project on 6 Aug 2026. It fits more easily than Copilot Studio — and there is no tenant control over which endpoints an agent may reach, so here we brake rather than govern. A2A endpoints register the same way; that is next.
Read in their documentation. Not yet run against a tenant.
Read in their documentation. Not yet run against a tenant.
On the list. It will say so here when we have run it, and not before.
Your code calls us. That is a gate you invoke, not a boundary you cannot avoid — and our own coverage engine grades it lower on purpose.
The column nobody else prints: how we know. Two of these we ran ourselves in a live tenant. Two we have only read. One we have not opened. A shorter list that holds beats a longer one that does not — and this table is re-checked on the first day of every month.
Live demo — nothing to fill in, no email, no password
Start in a sandbox where nothing is interposed in front of the agents. The gate still runs and the decisions are real — but the coverage engine reports PARTIAL, and it names why: the gate proves it ran, and nobody attests the agent cannot route around it. That is the honest state of an agent nobody put a boundary in front of, and no amount of configuration changes it. Then look at the one that does have a boundary.
See it working → Or go straight to the real one, running in its own network →
Acme Corp is not a mock-up: it is a gateway running in its own Azure network, in front of its own billing tools, writing its decisions to its own hash-chain. You can read the box’s half — its live decisions, straight from its chain — and our half, where it comes out GOVERNED with the reasons named. Neither page needs a credential, and not one of Acme’s rows passes through us to reach you.
The demo above and a real deployment are the
same service and the same calls — the only difference is
whose agents are on the other side. Connect registers your first
agent and shows the three universal paths to get the ones you already run seen. No sales call.
This one opens empty on purpose. Nothing is seeded: what appears will be your agents and your rules, and it starts out honestly empty. The sandbox above is a separate door — nothing you do there lands here.
Acme is still our tenant and our policy. So we also took the published transcripts of an independent benchmark — 204 recorded turns from 13 frontier models, among them GPT-4o, Claude Sonnet 4, Gemini 2.5 Pro and Grok 3 — and ran every one of them back through this layer. No API key, no network, deterministic.
See the independent evidence →Compliance
The AI Omnibus entered into force on 27 July 2026 and pushed the high-risk obligations to 2 December 2027 — and to 2 August 2028 for AI embedded in certain products. That is more time to prepare, not less to prove, and we are not selling you a deadline. We point at three articles only because they describe, almost line by line, what this layer already produces. Article 12 asks for automatic event logs over the system’s lifetime: every governed decision is an append-only, SHA-256 hash-chained row, and altering a past one names the exact sequence where the chain breaks. Article 15 asks for resilience against attempts to alter a system’s use or outputs — which is a description of multi-turn drift, and our answer is structural: the mission is signed outside the agent and the gate sits in the execution path, not in the prompt. Article 13 asks for output a deployer can interpret: the verdicts are typed and carry their reason, and replay is deterministic.
This is not a compliance certificate. Whether your system is high-risk under Annex III is your counsel’s call, not ours, and no vendor makes you compliant on its own. What we provide is the evidentiary surface those articles ask for.
How we charge
There is no price list on this page yet — deliberately. The model below is the whole of it, and we would rather quote you a number we can hold than publish one we have to raise. Ask us and you get a scoped figure with the assumptions written next to it.
A governed step is one call. That is the entire meter. Not seats, not agents, not tokens, not the size of your prompts, not how much data you send. Ten steps is ten calls. You can predict your bill from your own logs before you talk to us.
The four trajectory monitors, the admissibility gate, the auto-calibrated thresholds and the recomputable audit are in every agreement. There is no tier where the drift monitor is switched off, and no upsell to turn on the part that matters. Volume changes; the layer does not.
The price per governed step falls in bands as your volume rises, by close to an order of magnitude between the smallest and the largest. Governing every agent you run should never be more expensive per step than governing one.
A price that makes you pick which agents to govern has already lost. The whole argument of this page is that drift is invisible one step at a time — so a layer you can only afford on some of your traffic is a layer that measures the wrong trajectory.
| Input | How it moves the number |
|---|---|
| Governed steps per month | The only meter. The per-step price falls as the volume rises — you are not penalised for governing more of your fleet. |
| Where it runs | The hosted API (nothing to install), inside your own VPC, or on-premise with the in-process SDK, licensed per site. Same governance in all three; the operating cost is not the same. |
| Whether you put a classifier on the blocking path | That step pays a model call and its latency. The structural gate never does — it decides in microseconds without a model. You choose which steps are worth the difference. |
| Contract terms | Data-processing agreement, retention window, support hours, uptime commitment. Named line by line, never folded into the per-step figure. |
Architecture first, number second. Every input above is settled before we quote, so the quote does not move afterwards.
Any figure we quote is net. Payment-processor fees and applicable taxes (VAT, sales tax, withholding) are additional, and appear as their own lines in the quote — never absorbed into the per-step price to make it look smaller.
| Path | Model call | Guarantee |
|---|---|---|
| Structural gate — scope, hard caps, unverified claims, destructive commands | No | Deterministic and replayable. No score can re-admit a blocked action. |
| Semantic drift channel — advisory | Yes, off the blocking path | Classifier-dependent. It can raise a signal the structural layer missed; it can never lower one. |
| Declared classifier constraint — blocks in the same turn | Yes, on the blocking path | Classifier-dependent, and you sign what happens if the judge is down: block, warn, or proceed unprotected — reported as unprotected. |
How to read the middle column. It says whether that path has to ask a model. No = decided by set membership and arithmetic, in microseconds, and it always returns the same answer. Yes = it depends on a model: it costs time and money and it can be wrong, so it only happens where you ask for it. And advisory means that path warns but does not block — it can raise a signal the gate missed; it can never lower one it caught.
The gate that blocks never waits for a model. A step that is already inadmissible is decided in microseconds and the judge is not called at all. Where you declare a classifier constraint, that step pays your judge's latency — we would rather write that here than let you find it in production.
ASK FOR A SCOPED NUMBER
Tell us roughly how many agents you run and how many steps a month, and we come back with a scoped figure and the assumptions written next to it. You do not need to wait for us to try it — the library and the container run in your own infrastructure today.
Need to hand this to someone who does not write code? The nine-page guide (PDF) covers the whole argument, sources included.
Every plan runs on the hosted API — one call per step, nothing to install. Self-hosting adds the in-process SDK inside your own environment, licensed per site: same governance, no network hop.
By default the audit trail records digests, not your agent's raw prompts or data. On-prem and DPA available for regulated buyers.
The trajectory mechanism is patent-pending (US 19/640,556) and verified against the production kernel — not a slideware claim.
