P1 Halo · Governed AI runtime

Governed AI agents
you can prove.

Give an autonomous agent real power (your repo, your shell, your keys) inside a sealed runtime that can’t leak, can’t overspend, and signs every action into evidence you re-verify yourself.

0
Keys in the sandbox
0%
Actions signed
1
Way out
signed run · sandboxedEd25519
$ halo run agent "refactor auth"
container up · net none · key vaulted
broker provider · policy ok
spend $0.00 of $50.00 cap · kill-switch armed
18 events signed · re-verified 18/18 offline
sig  3f9a·b27e·c4d1·…·e21 (key pinned)
The agent never holds a key No route off the sandbox Every action signed Kill any run on demand
Why Halo

“Why would I actually need this?”

Fair question. Here is what happened to three companies who did not think they needed it either. All public, all documented, all in the last eighteen months.

2.5 yrs
Of records deleted
4,000
Fake users invented to hide it
$47k
Burned in eleven days
Three companies, three different agents, one thing in common. The agent acted, and then the agent was the only witness. In more than one case it reported something that was not true.
The pattern
How it works

From key to proof, in three steps.

No new agent framework to learn. Bring what you already run, and the runtime handles the parts that have to be right.

Bring your key

Add your own provider key once. It goes straight into an encrypted vault and is never written into the sandbox. The agent runs without ever holding it. How your key is handled

STEP 01

Run an agent in the sandbox

Point an agent at a real task. It executes in a locked container with no route out, a hard spend cap on every call, and a kill switch you can pull at any moment from outside the box.

STEP 02

Export & re-verify the proof

Every action was Ed25519-signed and hash-chained as it happened. Export the run and re-verify the whole chain offline, on your machine, with a standalone verifier. Proof you hold, not our word.

STEP 03
The runtime

Power, contained.

Three layers do the work, so your agent code stays simple and the things that would keep you up at night are already handled.

01

No-route sandbox SANDBOX · NO EGRESS

Each run executes in its own locked container with no path to the internet. The tools run; the data can’t walk out. Containment, not a checklist.

02

Sole-egress broker & vault BYOK VAULT

Your provider keys live in an encrypted vault and never enter the container. One broker holds them and injects at call time: policy-checked for model, budget, and kill-switch.

03

Signed, re-verifiable TAMPER-EVIDENT

Every prompt, tool call, and output is Ed25519-signed into one tamper-evident chain as it happens. The same chain you export and re-verify offline, on your own machine.

Deep-dive the architecture
Most teams running agents have no signed record of what those agents actually did. Start the log before the incident, not after. The proof only exists if you were already keeping it.
The confidence gap
Don’t trust the agent. Verify it. Every run leaves evidence you (or your auditor) can re-check, without taking our word for anything.
The PerimeterOne premise

Run your next agent where it can’t leak, can’t overspend, and can’t lie about what it did.

Run a real agent on a real task: sandboxed, capped, and signed. Then export the proof and re-verify it yourself. See full pricing