1
Your agent
through its SDK, adapter or coding-agent hook
holds a run token,
never a key
decide this call?
allow · deny · ask
OUT OF THE AGENT'S REACH
a separate user, a sidecar or a central host
2
Signer
decides with its own policy, before the call runs
allowdenyask a person
signs every call, decision and result into one hash chain per run
1234567
a missed event becomes a signed gap
3
Witnesses
cosign each checkpoint; a monitor watches the log from outside
checkpoints
4
run.tkb → tracekit verify
offline, with the keys and witnesses you pinned
VERIFIED or FAILED at the record that changed
export a file per run