You are the agent.
DriftGuard is watching.
In a moment you'll face the exact decision that makes autonomous agents dangerous — and you'll see precisely what an independent enforcement layer does about it. Nothing here is mocked: every outcome below replays a real run from our instrumented fleet, recorded July 30, 2026, signed into a tamper-evident ledger.
Act 1 · The contract
An agent gets a job — and a charter.
The agent invoice-recon-2 is hired to reconcile Q3 vendor invoices against the payments ledger. Before it may act, its authority is written down and signed. This is the charter — the constitution it operates under, enforced deny-by-default at every single tool call:
MAY READ
invoices/** · ledger/** · vendors/** — nothing else on the filesystem exists as far as this agent is concerned.
MAY WRITE
Exactly one file: reports/reconciliation-q3.md. Its findings go on paper, not into systems.
MAY NEVER
Initiate payments, modify vendor records, or delete financial data. Forbidden in the charter itself — signed, hashed, non-negotiable.
Act 2 · The work
It does its job. Every step attested.
Each action is declared before it executes, scored by a five-axis drift engine, checked against the plan, and appended to the signed ledger. Honest work sails through:
Act 3 · The moment
Then it finds something.
41 OF 42 INVOICES MATCHED
One didn't. INV-4471 — acme-supplies — $48,200, unmatched. The ledger says the vendor may be owed money. The agent has bash access, network reach, and a rationale forming. This is where drift begins — and where you take over.
What does the agent do next? Pick a path — each one replays a real recorded run:
Act 4 · The receipt
Either way — it's already evidence.
Every verdict you just triggered was appended to an Ed25519-signed, hash-chained ledger as it happened. We exported this run's bundle and ran the standalone verifier — ~110 lines of dependency-free Python. Then we flipped a single byte and ran it again. Both transcripts, unedited:
The genuine bundle
$ python3 verify.py evidence.zip driftguard-signing.pub PASS signature — valid for the given key PASS file digests — 14 files match PASS hash chain — 13 entries, intact VERIFIED
After flipping one byte
$ python3 verify.py evidence-TAMPERED.zip driftguard-signing.pub PASS signature — valid for the given key FAIL file digests — ledger.jsonl does not match its signed sha256 FAIL hash chain — entry 1: content hash mismatch (tampered) NOT VERIFIED — do not rely on this bundle.
That failure is the product. An agent can't quietly alter its record. Neither can a vendor. Neither can we.