PerimeterOne
P1 Halo · Governed AI runtime
Governed AI agents you can prove.
Give an autonomous agent real power (your repo, your shell, your keys) inside a sealed runtime that can’t leak, can’t overspend, and signs every action into evidence you re-verify yourself.
- Keys in the sandbox
- 0
- Actions signed
- 100%
- Way out
- 1
- The agent never holds a key
- No route off the sandbox
- Every action signed
- Kill any run on demand
A signed run
Every step, on the record.
This is what one run leaves behind. Each line is signed as it happens, and the whole chain re-verifies offline on your own machine.
$ halo run agent "refactor auth"› container up · net none · key vaulted› broker → provider · policy ok› spend $0.00 of $50.00 cap · kill-switch armed✓ 18 events signed · re-verified 18/18 offlinesig 3f9a·b27e·c4d1·…·e21 (key pinned)
Why Halo
“Why would I actually need this?”
Fair question. Here is what happened to three companies who did not think they needed it either. All public, all documented, all in the last eighteen months.
Three companies, three different agents, one thing in common. The agent acted, and then the agent was the only witness. In more than one case it reported something that was not true.
How it works
From key to proof, in three steps.
No new agent framework to learn. Bring what you already run, and the runtime handles the parts that have to be right.
- 01
Bring your key
Add your own provider key once. It goes straight into an encrypted vault and is never written into the sandbox. The agent runs without ever holding it.
How your key is handled - 02
Run an agent in the sandbox
Point an agent at a real task. It executes in a locked container with no route out, a hard spend cap on every call, and a kill switch you can pull at any moment from outside the box.
- 03
Export and re-verify the proof
Every action was Ed25519-signed and hash-chained as it happened. Export the run and re-verify the whole chain offline, on your machine, with a standalone verifier. Proof you hold, not our word.
The runtime
Power, contained.
Three layers do the work, so your agent code stays simple and the things that would keep you up at night are already handled.
No-route sandbox
Each run executes in its own locked container with no path to the internet. The tools run; the data can’t walk out. Containment, not a checklist.
Sole-egress broker and vault
Your provider keys live in an encrypted vault and never enter the container. One broker holds them and injects at call time: policy-checked for model, budget, and kill-switch.
Signed, re-verifiable
Every prompt, tool call, and output is Ed25519-signed into one tamper-evident chain as it happens. The same chain you export and re-verify offline, on your own machine.
Most teams running agents have no signed record of what those agents actually did. Start the log before the incident, not after. The proof only exists if you were already keeping it.
Don’t trust the agent. Verify it. Every run leaves evidence you (or your auditor) can re-check, without taking our word for anything.
Run your next agent where it can’t leak, can’t overspend, and can’t lie about what it did.
Run a real agent on a real task: sandboxed, capped, and signed. Then export the proof and re-verify it yourself. See full pricing