Skip to main content
Proofable stops every agent action you never allowed before it runs, and lets the next agent or system check finished work instead of paying to redo it. Each result below is measured on the live service against the setup teams use today, and links to a record you can check or a test you can rerun.

​
Results

​
Where it covers you

​
What it stops

​
Governance coverage

48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. 48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. 48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. 48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. AgentGovBench is the open library of 48 agent-governance scenarios in eight areas: audit completeness, cross-tenant isolation, delegation provenance, fail-mode discipline, identity propagation, per-user policy, rate limits and scope inheritance. Each scenario is tagged with the NIST AI RMF controls it tests, and nothing passes on a technicality. Against the agent tools teams already use, from the maintainers’ published results, where Proofable also handles 48 of 48: Why coding agents on their own handle 13, the best gateway handles 46, and Proofable handles 48:
  • Coding agents on their own (13): Claude Code, Codex CLI and Cursor only have local tool-permission prompts (allow/deny bash or file access). They have no owner-bound agent identity, no cross-agent delegation, no spend caps, no external policy engine and no signed audit trail.
  • A stateless API/MCP gateway (46): a proxy in front of tool calls enforces rate limits, role-based access, tool allowlists and server logs.
  • The two checks a stateless gateway cannot pass (48): a proxy only sees the request in flight. It cannot verify (1) an owner-signed, revocable delegation binding the person to that specific agent, task scope, spend cap and expiry, such as holding a sub-agent to a narrower scope than its parent, or (2) a signed execution receipt (qHash) binding input, policy state and output, so the next agent or an outside reviewer can verify what ran offline without trusting the gateway’s database.
See where your own agent stands. Paste your agent’s repository and one run scores it on the same 48 scenarios beside Proofable, scans the repository and its MCP surface, and probes your MCP endpoint when the repository names one: run the audit on your agent.

​
Agents only do what you allowed

8 of 8 permission tests pass on the live service. Every action outside the agent’s permission is stopped before it runs, and every action it is allowed to take runs. Each row opens its signed record. Reviewers in the AgenTrust integrations project verified the records offline on their own machines: every checksum matched and every signature verified. Its maintainers then chose them as the dispatch evidence for their authority comparison. Rerun all eight on your own account with Run the chain.

​
A hijacked agent cannot send your data out

When an agent was taken over, a scoped permission refused 6 of 6 attempts to send private data out, before they ran; an all-purpose key let all 6 through. The scoped agent still finished every task and never used a tool it did not need; under the all-purpose key, 14 of 36 runs did. Measured across 84 live runs, five published attack templates and two models, with a signed record for each run. Run the test on your own agent.

​
Records nobody can fake

150 of 150 forged records caught. Each of 15 real records was changed ten ways, such as editing the content, swapping the owner or flipping one bit of the signature. Every changed copy failed offline signature verification and every real record passed. A check that only reads the format accepted all 150.

​
What it saves

​
Reuse instead of redo

750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. 750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. 750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. 750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. Redoing a finished agent job took 2.79 s and 2,426 AI tokens. Checking its signed receipt took 3.7 ms and no tokens: 750× faster, which is 1 hour instead of 32 days at a million checks. Time it yourself.

​
Handoffs between agents

Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. When one agent hands a finished result to another (LangGraph, CrewAI, AutoGen), the receiving agent normally either trusts the forwarded text blindly or pays to re-run the upstream work. With Proofable, the producing agent emits a 66-byte signed receipt (qHash) binding input, policy state and output, and the receiving agent checks it before acting.
  • 3.3× cheaper than redoing the work: $0.024 per correct outcome** (33,240 tokens, 2 model calls per task) against **$0.078 (124,715 tokens, 3 to 5 model calls per task).
  • Trusting forwarded text is cheap and wrong: it costs $0.009 on untouched input, but when the text was changed in transit it used the tampered value 3 of 3 times. Checking the receipt caught every change 3 of 3 times and still completed every task.
  • 29× smaller handoffs: across a 10-hop chain, passing the signed reference carried 9,900 bytes per hop instead of 289,410 bytes of full evidence.

​
Memory that knows what is current

Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. Most agent memory layers (Mem0, Zep, vector stores) return text chunks with no active or revoked status and no signer, so the agent keeps reading full bodies to work out which rule is current. Proofable stores typed, revocable, owner-signed records (rules, instruction, receipts), so the agent asks for active state by type and reads about 1 KB of verified metadata before opening a body. On a 1,721-record production vault, the same questions took 105,347 tokens in 56 seconds (7 model calls) by typed lookup against 4,462,980 tokens in 493 seconds (55 model calls) searching record bodies by keyword: 42× fewer tokens, 8.8× faster, and 14.6× to 18.9× lower model cost across Claude Sonnet 5.5, Gemini 3.1 Pro and GPT-6 Astra. On three direct probes, typed lookup ranked the target record first every time; keyword search pulled 61 KB to 63 KB of bodies, ranked the right plan fourth, and missed the active model-provider rule entirely.

​
Research with a cost ceiling

Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). Live pages change between requests: two fetches of the same page 221 seconds apart returned 96,713 characters, then 1,129, handing two agents different evidence with no way to prove what the page said when the decision was made. On public questions about standards, agent protocols and regulation, reading signed Proofable records halved the cost per correct answer ($0.020 vs $0.039), held the worst case to 16,301 tokens where open-web search spiked to 50,554 tokens and 104 seconds (3.1× lower), and cited a checkable source on every answer (6 of 6, against 5 of 6 on the open web).

​
Identity checks paid for once

A person or business completes an interactive check once, and downstream apps and agents verify the portable proof instead of paying the vendor to run the flow again. Priced from published vendor list prices and Proofable’s $0.0025 per check:

​
Run it yourself

Time a reuse on your own machine, with no account and no API key:
It reads a finished job by its id and verifies the signed receipt on your machine:
Pass any public record id to time that record instead. To put receipts on your own agent’s work, add Proofable to your AI tool.

​
Run it on every pull request

Add one workflow file and the eight permission tests run in your CI, on your account, with every record verified offline and kept as a build artifact:
Pin both refs to the same commit so a rerun measures the same kit. The action writes a trustharness.report/v1 report with each case’s outcome and whether each record verified offline, and fails the job when the offline check fails. Action and report schema.

​
Details for reviewers

The latest run of the permission tests produced 15 signed records. Check all of them on your machine, with no account:
  • Governance: the current AgentGovBench library (commit 479c5f0) run against the exact policy code the live service runs, matched to it by hash, beside a gate that allows everything and no governance. It measures the decision logic rather than the hosted service end to end. The agent-tool rows are the maintainers’ published end-to-end runs on the earlier library (commit e0ce93a), where the same engine also handles 48 of 48.
  • Permissions: each test on the live service with a dedicated agent under its own fixed permission, and the full suite again on a production release. A revocation that lands while an action is in flight is re-checked at the executor’s own boundary and refused with a typed reason.
  • Takeover: 84 live runs across five published attack templates and two models, with a signed record for each run.
  • Reuse: the median of ten runs on one finished job on the live service.
  • Handoffs: three public downstream tasks, one run per option, code-graded, with a separate producer and consumer agent on the same model. Dollar figures price the measured tokens at the Claude Sonnet 5.5 list rate ($2 input, $10 output per million). The 10-hop payload sizes are over the 15 published records.
  • Memory: the same agent and model on both options, one run each. It compares typed lookup of active state (by record scope and status before a body is fetched) with full-text keyword search over record bodies; it is not an embedding-similarity benchmark.
  • Research: six public questions, one run per option, same agent and model. Both options answered 6 of 6 correctly, so it measures cost ceiling, tail spread (1.3× against 6.1×) and provenance rather than accuracy.
  • Identity: a pricing model from published list prices, not a live run.
Every script behind these runs is public in public/evidence/benchmarks, pinned by commit and checksum.
Each result maps to the published control it gives evidence for. None of these mappings is a certification or a compliance opinion.The frameworks: OWASP Top 10 for Agentic Applications 2026, the EU AI Act, the NIST AI RMF, the NIST NCCoE agent identity and authorization project and CAIP-380.
Last modified on November 2, 2026