Is every AI still acting exactly as you approved?
Someone approved each AI application once. Since then a tool may have changed, or a credential been used for something new. Autonomous Integrity asks, for every application and continuously: is it still acting as approved?
Approval is a moment. Integrity is whether it still holds.
Drift alarms speak only when something changes, so a healthy estate and a silent detector look the same. Autonomous Integrity counts the whole population first, in control, drifted, never reviewed or overdue, then ties each part to the application a business signed off.
Composes, never re-judges
Every reading comes from the part of the platform that computes it: MCP tool drift, agent-card checks, probes, the supply-chain register. The chain view and the per-question view can never disagree.
Gaps named in the payload
Where a question applies and nothing answers it, the page names the gap and what it would take to close it, including checks your plan does not hold.
Act from the same view
Stand a surface down so it cannot act, accept a new shape, allow it back, declare an application’s parts and accept its chain.
Integrity is not one property.
Every part of a chain is asked the same plain questions. Each one is a different way an approved AI can stop being the thing you approved. Together they form the hexagon seal, read clockwise from the top.
Approved with one set of tools, later carrying another. A rewritten tool description is quieter still, because the description is text your model obeys.
An approved shape is worthless if what presents it today is not what you approved. Read from credentials, key pinning and signed agent cards.
A surface with no ceiling inherits whatever it is later given. A bounded one makes a drift finding survivable.
A model or vendor with an open advisory is a problem you did not introduce and cannot see from its behaviour.
Shape is what a thing declares. Behaviour is what it does under adversarial probes and in live traffic, and the two can diverge.
An agent calling another agent, then a tool, should end with less authority than it started with, never more.
Everything that can act for you, in one place.
The parts of a chain come from different corners of the platform. Each plane is the same question asked locally: what was approved, what is there now, and has anyone looked recently.
Software someone else runs, which your agents may call over MCP. Each advertises tools, and each tool carries a description your model reads.
Drift: a server redefines a tool, or its description, after approval.
Agents belonging to a partner, a supplier or another part of the business, that your agents talk to over A2A.
Drift: a peer advertises a new or rewritten skill in its agent card.
Instructions your own people wrote and shared, which anyone in the organisation can pick up and run.
Drift: a shared skill’s instructions or allowed tools change after use begins.
Agents your people built and shared in the Governed AI Workspace. The instructions are the agent.
Drift: a shared agent’s instructions change after use begins.
The keys your agents and services present at the gateway, with the calling host, tool scope and model scope enforced at the call.
Drift: a credential is widened, or used, beyond the scope it was approved with.
What the sensor finds on people’s machines: coding agents, IDE extensions, locally configured MCP servers and skills on disk.
Finding: something that can act is installed and nobody has said what it is.
Measured. Does not arise. Not read.
For every part and every question, the answer is exactly one of three things. Counting a question that cannot apply as a gap makes the estate look worse than it is. Counting a real gap as not applicable makes it look better. So the two are always kept apart.
A verdict was read from whatever computes it: sound (solid), partial (hatched) or weak (red). Each carries its evidence and its source.
The question cannot apply to this kind of part, and the reason is given. A skill your own people wrote has no outside identity to establish.
The question applies and nothing answered it. This is a gap, it is named, and the page says what it would take to read it.
A check your plan does not hold is shown as not measured on this plan, with the plan that would measure it. It is never counted as sound.
Each application is rated by its weakest hop, never an average.
A chain compares two things: what a person declared the application is made of, and what actually acted for it in the last 30 days, read from the records the gateway writes. Then the worst hop decides the rating.
A part drifted since its shape was approved, something acted for the application that nobody declared, the gateway found data beyond the declared class, or the chain changed since it was accepted.
No owner is named, a part has never been approved, a declared part is no longer registered, or nobody has accepted the chain as a whole.
Nothing drifted, nothing undeclared, and a person accepted it. But its weakest hop reads weak, and the chain is only as strong as that.
Every hop matches what was approved, and nothing acted for it that was not declared. Any partial or unreadable hop is still named in the reason.
A part that has been stood down cannot act and does not vote. A part shared by two applications is one part: if it drifts, both change state at once.
The integrity view, on a demo estate.
Six applications you will recognise, drawn with the same seal, map and wording as the platform. Click an application to open its chain, a hop to see why it reads as it does, or switch to the estate map.
Demo estate. Every application, part and reading here is illustrative.
A dated statement someone outside the console can check.
A passport records one application’s chain as it reads at a moment: what was accepted and by whom, every hop with its own sentence, and, just as prominently, what could not be read. It never says “compliant”. A new one is issued when one is needed.
Hash-chained
Issuing a passport appends it to your tenant’s evidence chain, an append-only SHA-256 hash chain in which each record commits to the one before it.
Tamper-evident, not signed
Edit, delete or reorder a record and verification names the first broken link. There is no private key involved, so a passport is not a digital signature, and we do not call it one.
Travels with the evidence
Passports go inside every evidence pack, whose README explains how to recompute the chain independently. Personal details beside privileged roles are left out; the owner and the person who accepted the chain are named.
See which of your applications still hold.
We will draw the chains of the AI you already run, and show where each one reads weak, unapproved or not read.
Questions buyers ask.
Does Autonomous Integrity detect threats itself?
No. It composes readings other parts of the platform already compute, such as MCP tool drift, agent-card verification, probe results and the supply-chain register, onto the applications your business approved. Every reading opens onto the check that produced it.
Why the weakest link and not an average?
One drifted tool server inside an otherwise pristine application means the application can be steered. An average would hide exactly that, so an application is only as strong as its weakest hop.
What is the difference between does not arise and not read?
Does not arise means the question cannot apply to that kind of part, and the reason is given. A skill your own people wrote has no outside identity to establish. Not read means the question does apply and nothing answered it, and the page says what it would take. Merging the two would make coverage look better or worse than it is.
Is a passport digitally signed?
No. A passport is appended to your tenant’s evidence chain, an append-only SHA-256 hash chain in which each record commits to the one before it. That makes it tamper-evident: edit, delete or reorder a record and verification names the first broken link. There is no private key involved, so it is not a signature.
What can a person do from the integrity view?
Stand a surface down so it cannot act, accept a new shape, allow a surface back, declare what an application is made of and accept the chain as a whole, and issue a passport.