PROVABLE AI
What is Provable AI?
A category name for what regulated AI has been missing: the ability to prove — — that an AI agent could not have crossed the line you drew, and to hand you an , without trusting the vendor who produced it.
01 — The question nobody could answer
Can you prove your agent ?
Ask a monitoring vendor whether an AI agent stayed inside its rules and the honest answer is a version of we watched, and nothing looked wrong. Guardrails, red-teaming, evals, an LLM grading another LLM — these observe, sample, and describe. They tell you what was probably fine under the conditions you happened to test.
None of them prove. A proof is not a narrative about behavior and not a statistical pattern around it. It is a formal guarantee that a specified thing cannot happen — over every case in a class, not the cases you sampled.
Detection tells you nothing looked wrong. A proof tells you the wrong thing is impossible.
02 — The reframe
Not “probably safe.” Provably impossible — and you leave with the proof.
A model that judges a model is promptable: it can be talked out of its verdict, because it is itself a probabilistic system. A solver is not. When we prove a rule holds, we are not scoring a trajectory — we are showing that no execution in that class violates the rule, for an unbounded number of steps.
The second half is the part the market does not offer today. Formal verification exists — but it lives inside a cloud you cannot audit, or it arrives as a consulting report. Either way you do not walk away holding the proof. We hand you the artifact, and an independent verifier re-checks it offline.
03 — What “provable” means, precisely
Two layers on every surface.
Provable AI is not a vibe. On each surface we run — agent actions, code, cryptography — there are two distinct layers, and only one of them is the moat.
Broad. Probabilistic.
Flags what looks wrong across everything. Useful, and everyone in the field does some version of it. It can miss, and it can be argued with.
Narrow. Absolute.
On the provable class, UNSAT— no case violates the rule. Not “we didn't find one.” None exists, and the artifact says so in a form anyone can re-check.
Z3 / Spacer
The solver synthesizes the inductive invariant itself and proves the rule holds over every trajectory.
Post-quantum
SHA3-512 hash chain, signed Ed25519 + ML-DSA-65 (FIPS 204). Tamper is detectable.
Offline
An independent verifier re-checks the sealed artifact without ever contacting us.
04 — How the proof is built
We don't ask you to trust the discovery.
A solver that finds an invariant is convenient but not evidence — you would be trusting the search. So before anything is sealed, we re-extract the inductive invariant and discharge its verification conditions as UNSAT in a fresh solver, derived from the proof obligation itself. Discovery and re-check are separated on purpose.
The policy the prover reads and the policy the runtime enforces come from one compiler, not two hand-copied encodings — a differential check fails the build if they ever diverge. Two artifacts that must agree, with something that breaks when they don't.
04b — The honest surface
What we ask you to trust, named.
The cryptographic base is NIST standards — SHA3-512, Ed25519, ML-DSA-65 (FIPS 204) — not cryptography of our own. Those assumptions are negligible in the security parameter.
The rest we name rather than hide: the solver's UNSAT decision (mitigated by the independent re-check above), that the model faithfully encodes the policy (held by the single-compiler discipline), and that the declared threshold is your firm's chosen number — we prove the configuration stays under the limit, not that the limit is the right one.
A limitation you state is an asset. The same limitation left unspoken is the thing that detonates in review.
05 — The artifact
A sealed certificate you can carry out the door.
Each governed decision emits a self-contained record binding identity, scope, authority, the decision, the proof, and the resulting state change. Records accumulate into an append-only, hash-chained stream — editing one entry breaks every entry after it.
The seal carries a time witness, and it is honest about how strong that witness is: it reports one of bounded, one-sided, self-declared, or none — so “consistent with the rules at that time” is backed, never assumed. If the network is down, the seal degrades honestly instead of faking a timestamp.
06 — What it isn't
Provable AI is not a rebrand.
Not monitoring
Observability describes execution for debugging. It doesn't authorize, and it doesn't prove. You can have both — they are different things.
Not an LLM judge
A model grading a model is probabilistic and promptable. A solver's UNSAT can't be talked out of its answer.
Not a TEE
An enclave attests that code ran intact. It can still take an unauthorized sequence of actions. We attest to the shape of the trajectory itself.
Not blockchain
No tokens, no public chain, no minting. Cryptographic integrity used where it belongs — inside an enterprise runtime.
Not planner safety
Prompt injection can compromise the planner. We are confinement: even a compromised planner can't produce a proof-valid execution outside its contract. Upstream hardening is separate and necessary.
07 — What it does not solve
Sharp primitive, sharp edges.
Valid under policy is not good policy
We prove the agent stayed inside the boundary the policy fixed. We say nothing about whether that boundary was well chosen. A policy that authorizes harm yields a valid proof of harmful-but-authorized execution.
A proof cannot confer authority
We prove the action stayed inside the policy in force, and that the policy is not operable until a designated quorum dual-signs its exact fingerprint — weaken a guard after sign-off and the schema stops being enforceable. What we cannot establish sits upstream of any code: that the people holding those keys were entitled to hold them, that their mandate is still current and in scope, or that whoever refuses to sign is protected when they do. A gate can be made unbypassable. The right to open it comes from somewhere else.
Authorized is not safe
A fully authorized action can still be the wrong action in the world. We govern the trajectory, not the wisdom of the capabilities you granted.
In-process hostile code is physics
Arbitrary hostile code sharing the runtime can call an effect directly. That is true for everyone in this category — we name it in the code rather than paper over it.
Composition has a frontier — and it moved
Six axes of structuring are proven closed over every sequence rather than a large sample: amount, time — at arbitrary window width — number of accounts — at unbounded fan-out width — combined action types, money routed through intermediary entities at arbitrary hop depth, and velocity, proven with all four amount controls in force, because the burst is the case they all approve. Five rest on an inductive invariant the solver had to discover; the fixed-window result closes by direct contradiction instead. We say which is which rather than let one word cover both.
A proof cannot source what you cannot seeROADMAP
The layering proof closes the route on one condition: that value can be attributed to its origin. Whether that attribution is obtainable across institutions is a question for data and for law, not for a solver — a different question, with a different owner. Concurrent origins sharing an intermediary, a blended pool attributed pro rata, and rate measured per entity across accounts stay open. Behavioural anomaly — “unusual for this customer” — is not a threshold property at all, and nothing here addresses it.
08 — Regulatory mapping
Answer examiner questions from the artifact.
The proof-and-seal structure maps onto current supervisory expectations for agentic AI — the enforceable, machine-checkable subset, not a marketing translation. A firm answers “show me it couldn't” from the sealed record instead of from a narrative.
Wedge: regulated Canadian financial services. Mapping is scoped to the machine-enforceable control objectives, not a claim of full-framework coverage.
09 — Ironproof's role
One engine. Several surfaces. Honest about each.
One solver-and-seal engine drives every surface. We state maturity per surface rather than blur them together.
10 — The phrase, one more time
PROVABLE AI
Prove your infrastructure.
Request access and turn policy into enforceable, independently verifiable guarantees.