KEEL is the vendor-neutral system-of-record for AI accountability. It verifies every autonomous agent action before it executes — blocking catastrophes, catching fabrications, and earning trust from evidence — then signs tamper-proof proof your auditor, insurer, and regulator now require.
Works with any agent framework — LangChain, OpenAI SDK, CrewAI, Claude Code, Cursor, custom. Deterministic checks in ~2ms. Every decision signed & logged.
AI agents now act: they send messages, move money, run commands, change data. When they act wrongly, the company pays. Yet nothing stands at the moment of action with a guarantee — and no standard proof of control exists.
Database drops, funds transfers, recursive deletes, credential exports, mass sends are refused unconditionally — even in shadow mode, even for a trusted agent. A human can't be tricked into approving what's never offered.
Scope, budget, and rate limits per action class. Every claim is checked against its cited evidence: invented numbers and out-of-context quotes are stopped deterministically.
Per agent and action class, KEEL computes an anytime-valid lower bound on success from externally-verified outcomes, with drift detection and conformal risk control. Routine work earns its way to auto-approval; risky or novel actions go to a human.
Every decision becomes an Ed25519-signed certificate in an append-only Merkle log. Export a standards-mapped evidence pack in one click.
Deploy as an MCP proxy that holds the tools: the agent physically cannot act without a decision. Or drop in the SDK / REST call. Fails closed.
Anytime-valid confidence sequences (valid under continuous monitoring), conformal risk control that self-tightens on harm, Page-Hinkley drift, behavioral anomaly detection.
Signed, Merkle-anchored, independently verifiable. The evidence auditors and AI insurers sample — mapped to EU AI Act, ISO 42001, and NIST AI RMF.
Any framework, any language, any field. One policy and one log across every agent you run — coding assistants to customer-service bots to back-office automation.
Every certified action is a labeled outcome. Your calibration corpus grows and can't be copied — the longer it runs, the more autonomy you safely unlock.
Abstention is a first-class answer. Guarantees state their exact scope on the certificate. A system that tells you when it doesn't know is one you can build on.
New agents begin in shadow mode: KEEL signs and records everything, blocks only catastrophes. Flip enforcement on when you trust what you see.
# pip install keel-trust · keel serve from keel.sdk import KeelGuard guard = KeelGuard("http://localhost:8347", agent_id="my-agent") guard.register(name="My Agent", action_classes={ "issue_refund": {"risk": "high", "budget_per_day": 500, "requires_evidence": True}}) @guard.protect("issue_refund", cost=lambda amount, **kw: amount) def issue_refund(customer_id, amount): ... # runs only if KEEL allows — or a human approves
Claude Code, Cursor, Copilot agents run commands and edit files. KEEL blocks the Replit-class database wipe and Gemini-class file destruction — before they execute.
Bots that issue refunds and change accounts have no built-in approval prompt. KEEL is the only thing between them and real money — with budgets, evidence checks, and a signed trail.
Payments, reconciliation, procurement. Velocity caps and earned autonomy stop the trust-farming attack that escalated a $500K limit into $5M of fraud.
Healthcare, finance, public sector. Risk-tiered escalation with recorded approver identity — the Article 14 human-oversight evidence your regulator asks for.
One click produces a self-verifying bundle: uniform-randomly sampled signed decisions with Merkle inclusion proofs, per-agent calibration tables, the human-oversight record, and control mappings. It proves itself from the log root.
Every capability is free for everyone — self-hosted or managed, no tiers, no licence, no card. What sets KEEL apart is not a plan, it's the architecture.