Promenaut1. Declared before it acts
An agent should say what it will read, write and call before it runs, and be held to that while it runs. A boundary that is only written in a document is a hope, not a control.
On Promenaut, each agent declares what it consumes and produces, a required input that cannot be resolved stops it before it runs, and the platform checks whether each agent’s declared outputs still match what its last run wrote.
Each agent’s declared boundary can be shown as a diagram: who admits it, who may call it, and what it may touch.
2. Authority comes from a person
An agent with its own broad credentials is a privileged account nobody owns. Authority should come from the person who started the work, and people should make the decisions that matter.
On Promenaut, an agent reaches knowledge as a deputy of the person who launched the work, within that person’s permissions, and a change an agent finds can be passed through a trust gate to a person instead of being made directly.
3. Evidence is a by-product of the work
Evidence assembled afterwards depends on someone remembering to assemble it. Evidence the work leaves as it ends does not.
On Promenaut, each workflow run ends with a verdict on whether the agents that ran matched those it launched with, each completed agent run records which model and provider answered, and an auditor can open a diagram of the whole run with its verdict laid over it.
4. No change without a record
A change to an agent, to who approved it, or to the rules it is judged by should be recorded in the same step as the change.
On Promenaut, an agent’s configuration changes by publishing a version, each lifecycle change is recorded with its reason and who made it, model risk events go to an append-only, hash-chained ledger, and reads of that evidence are recorded too.
5. Measure reliance, not only accuracy
What matters for risk is what people accepted, changed or ignored, and whether anyone accepts everything unread.
On Promenaut, co-authoring surfaces record when a person accepts, modifies or rejects a suggestion, the person who ran a workflow can rate it, and the figures can be exported for a reviewer.
6. Say what it will not do
A workforce that names its limits, and can be stopped, can be trusted with the rest.
On Promenaut, a module declares its intended use, human oversight and limitations in its manifest, work can be held for a person’s decision, and an operator can pause an agent so it is refused at its next dispatch.
What to ask of any agent platform
Is each agent’s boundary declared, and enforced while it runs?
Or only described in a document.
Whose authority does an agent act on?
The person who launched it, or an account of its own.
Does each run leave its own evidence?
Or is evidence gathered from logs afterwards.
Is each change recorded in the same step?
Including changes to approval and to the rules agents are judged by.
Can you see what people relied on?
Not only whether outputs were accurate.
Can you stop it, and does it say what it will not do?
Limits named up front, and a way to halt an agent.
Promenaut is running in production with leading industry partners, including a global tier 1 bank.
Common questions
What does compliance mean for AI agents?
A set of properties the work has while it runs: declared boundaries, authority from a person, evidence produced by each run, a record of each change, measured reliance, and named limits with a way to stop the work.
How do you prove what an AI agent did?
With evidence the run itself leaves. On Promenaut, each workflow run ends with a verdict on the agents that ran, each agent run records which model answered, and an auditor can open a diagram of the whole run.
Who is accountable for what an AI agent does?
The person whose authority it acts on, and the people who approve its sensitive steps. That is why authority should come from the person who launched the work, not from the agent’s own account.
Can an AI agent be stopped?
On Promenaut, yes: an operator can pause an agent so it is refused at its next dispatch, and a running workflow can be paused, stopped or cancelled.
