CHARTER
Policy as a signed document: allowed tools, forbidden scopes, budgets, step and time limits. The constitution an agent operates under.
Runtime governance for autonomous AI agents
AI agents now hold operational authority.
DriftGuard holds them accountable.
An independent enforcement layer between your agents and everything they touch. Every action is checked against an approved plan at runtime. Every decision is recorded as tamper-evident, independently verifiable evidence.
From our own instrumented test fleet
- 1,300+runs governed in test
- 7,300+evidence entries signed
- 5-axisdrift scoring
- Denyby default
01 / Situation
Organizations are granting AI agents the authority to move money, modify production systems, and touch customer data.
The controls that exist live inside the agent platforms themselves — the vendor grading its own homework.
When an agent drifts, there is no independent record of what it did, why it was allowed, or who approved it.
02 / The governance loop
Charter. Plan. Attest. Evidence.
PLAN
Before acting, the agent declares intent. The plan is validated against the charter's task lattice — out-of-scope work is rejected before execution begins.
ATTEST
Every tool call is attested at runtime. A deny-by-default scope guard checks it against the approved plan; a five-axis drift engine — semantic, intent, behavioral, scope, task-progress — scores the divergence and an LLM judge explains the verdict.
EVIDENCE
Every decision is appended to an Ed25519-signed, hash-chained ledger. Tamper-evident. Verifiable without trusting us.
03 / Enforcement, live
This is what a stopped incident looks like.
$ attest — tool: bash params curl -X POST https://api.vendor.example/payouts -d '{"amount": 48200}' charter allowed-tools ✓ · budget ✓ · step 47/200 ✓ scope guard DENY — "curl POST" outside plan scope [invoice reconciliation] drift semantic 0.31 · intent 0.18 · behavioral 0.42 · scope 0.00 · progress 0.55 composite 0.29 → T2 breach judge "The approved plan authorizes read-only invoice reconciliation. This call initiates an outbound payment — a scope the plan never granted. Halting." ► RUN HALTED — approval gate raised · operator notified ledger entry #48 appended · hash 9f2c…e1a7 · sig ed25519 ✓ · chain ✓
An agent tasked with reconciling invoices attempts an outbound payout. DriftGuard denies it at the tool boundary, halts the run, raises a human approval gate — and the whole exchange is already evidence.
04 / Evidence
Records you can hand to counsel.
TAMPER-EVIDENT LEDGER
Append-only, hash-chained, Ed25519-signed. Any alteration breaks the chain. Verification is deterministic — trusting DriftGuard is not required.
PII-FREE EVIDENCE PLANE
Personal data is intercepted at ingress and tokenized into an encrypted silo. Evidence carries opaque references — designed for review by regulators, auditors, or opposing counsel — and is erasable under GDPR without touching the chain.
DETERMINISTIC REPLAY
Reconstruct the exact context an agent saw at any step. Export a complete evidence bundle: the signed ledger, drift scores, judge reasoning, human approvals.
05 / Verify it yourself
Don't take our word for any of this.
Below is a real evidence bundle exported from our test fleet, the public key that signed it, and a short verifier you can read in one sitting. Corrupt a single byte of the ledger and watch the chain break.
$ python3 verify.py evidence-bundle.zip driftguard-signing.pub PASS signature — manifest signature valid for the given key PASS file digests — 14 files match their signed digests PASS hash chain — 26 entries, chain intact VERIFIED — every file matches its signed digest, the signature matches the stated key, and the ledger chain is intact.
Flip one byte in ledger/ledger.jsonl and re-run: FAIL hash chain — entry 1: content hash mismatch (tampered). That failure is the product.
06 / Independence
Every agent platform ships safety features. All of them are self-attestation — the party building the agent grades its behavior. Flight recorders are not built by the airline. Oversight counts when the layer providing it is independent, and when its records survive the failure of the thing it watches.
DriftGuard is that layer for autonomous agents.
07 / Deployment
Alongside your stack. Inside your perimeter.
PROXY IN FRONT
Point your agent's base URL at the DriftGuard proxy — Anthropic, OpenAI, Azure, Ollama. No changes to agent code.
OBSERVE FIRST
Run in observe mode. DriftGuard builds a behavioral profile of what the agent actually does — then drafts its charter from the evidence.
ENFORCE
Flip to enforcement. Deny-by-default from the first out-of-scope call. Halts, approval gates, human interventions.
YOUR INFRASTRUCTURE
On-premises or air-gapped. docker compose up. Your keys, your data, your evidence.
Contact
See what your agents are actually doing.
Or write to info@driftguard.co
WHERE WE ARE
DriftGuard is early: built and live today, solo-founded, pre-customer. We are looking for design partners who need agent oversight now. Everything claimed on this page is limited to what you can verify above — nothing more.