Eight independent layers of protection and accountability. Seven layers prevent unauthorized actions, data exposure, governance failures, and delegation drift. The eighth proves what the other seven did — years later, offline, even if H33 disappears.
An audit log answers what happened. Agent-008 answers why it was allowed to happen — and proves it.
"H33 does not make agents smarter. H33 makes them stop relying on memory."
Run the live demo → ✓ Verify it yourself in Proof Lab Install in 30 secondsStandalone Rust crate · ships alongside H33-Key and H33-Attest · 10 patents pending · 250+ claims
Every modern AI stack can tell you what an agent did. None of them — until now — could tell you, in a single verifiable artifact, why the agent was authorized to do it.
Agent-008 emits a Provable Authority Package with every action. The PAP carries the certified Root, the policy hash, the Read Attestation, the Delegation Capsule, the secret handle reference, the freshness window, the lifecycle state, and a citation to the original human sentence that authorized the work. A third party can re-derive every binding and reach the same accept-or-deny verdict the runtime reached.
Agent-008 is the governance substrate that sits underneath whatever framework you already use.
Frameworks let you build agents. Observability tools let you watch them. Agent-008 is the third leg: the substrate that decides whether they are allowed to act, on whose authority, and against what evidence. Composes with everything — replaces nothing.
Five things we will not claim. The market is full of products that quietly do.
Seven layers prevent. One layer proves. The number is the count, not the label.
For auditors, insurers, boards, regulators, and incident response, replay is arguably more valuable than the receipt itself. The seven preventive layers stop the action. The capstone proves what they did, six months or six years later, even if H33 disappears.
All four must return true. Any one false → the agent does not act, and the substrate emits a SecretDenied receipt naming exactly which one.
no_read_attestationcapsule_invalidnot_activatedstale_authorityEvery denial names the specific evaluator that failed. No silent reject. No silent allow.
The four evaluators above answer one question — Authority. A complete decision binds three more: was it permitted, what justified it, and were the conditions required for it true. All four must hold. Any one missing → the decision does not execute, and the substrate names which dimension blocked it.
Stale OFAC list → blocked at the gate. Never reaches the policy engine. Never produces a PAP another team has to chase. The dimension that blocked is named, with the artifact that would clear it.
An auditor opens the PAP. Every question maps to a field. Every field is independently re-derivable.
intent_hash + signed sentence.root_hash + version.policy_hash (Q-Sign).terminal_cert_hash.read_attestation_id.delegation_capsule_id + scope.handle_id + purpose.acknowledged_root_version = latest.lifecycle_state = active.window_open_at ≤ now < window_close_at.conflict_resolution_id if any.verdict + reason_code.A third party reads the PAP, re-derives the bindings, and reaches the same verdict the runtime did. Verifiable years later, even if H33 disappears.
{
"verdict": "allowed",
"verification_level": "aggregate_v1",
"intent_hash": <hash of the signed human sentence>,
"intent_citation": "Review invoices up to $25,000 and escalate anything larger",
"root_hash": <certified Root identifier>,
"policy_hash": <Q-Sign policy hash>,
"acknowledged_root_version": 7,
"latest_root_version": 7,
"lifecycle_state": "active",
"terminal_cert_hash": <the agent's TerminalCertificate>,
"read_attestation_id": <H33-Attest registry id>,
"delegation_capsule_id": <substrate-emitted capsule id>,
"window_open_at": 1781530000000,
"window_close_at": 1781616400000,
"secret_refs": [
{ "name": "STRIPE_SECRET",
"handle_id": <h33-key handle id>,
"purpose": "invoice_payment" }
],
"conflict_resolution_id": null,
"reason_code": "all_evaluators_satisfied"
}
Every field is a binding. Every binding is independently re-derivable. No field is a self-assertion; each one is verifiable against a substrate the agent did not control.
The risk the buyer is exposed to. The control Agent-008 provides. The proof an auditor can independently re-derive.
Standalone Rust crate. No daemon. No service. No cloud handshake.
$ curl -fsSL https://h33.ai/install/agent-008 | sh
# invoice-agent.json -- the request the agent will run under. # Raw secrets NEVER appear here. Handles only. { "name": "invoice-agent", "purpose": "invoice_payment", "secret_refs": [ { "name": "STRIPE_SECRET", "value": "h33k_01J6...HCN9", "purpose": "invoice_payment" } ] }
$ agent-008 run --request ./invoice-agent.json --pretty
{ "accepted": true,
"request_name": "invoice-agent",
"secret_refs": [
{ "name": "STRIPE_SECRET",
"h33k_id": "h33k_01J6...HCN9",
"purpose": "invoice_payment" }
],
"verification": { ... see PAP above ... } }
0 → action allowed (PAP on stdout) 3 → action denied (denial_reason on response) 1 → I/O or parse error
plaintext_value_rejected. No exceptions.value field at the type level — structural, not opt-in.Stages A through E shipped 2026-06-17. Stage G (Decision Integrity Infrastructure — the precondition gate, a new sibling crate) shipped 2026-06-29. Stage F (loopback HTTP front) is held pending a dedicated network-surface review.
aggregate_v1 — the full eight-layer verdicth33k_<id> refs. Reject any raw value at the type boundary. Response echoes refs only.env are routed through H33-Key, rewritten internally, zeroized, and the SecretCaptured receipts cited on the PAP.read_attestation_ids[]; verification_level reports stage_d_attest_bound. aggregate_v1 lands when the Root runtime gate wires in.agent-008 revoke marks a captured secret revoked; the next exec fires handle_revoked with a signed receipt. Authorized request → PASS. Unauthorized request → DENIED.blocked. Expired KYC → blocked. Customer-facing verbs: cleared / blocked / incomplete. The dimension that blocked is named on the response with the artifact that would clear it.Verification level reports honestly. stage_d_attest_bound today; aggregate_v1 when Root lineage verification wires into the runtime gate. Not a fake green check.
The substrate is uniform; the governance question is industry-specific.
over_amount_cap.No SDK lock-in. The contract is a JSON request and a JSON PAP. Anything that can spawn a process can pass through the gate.
An audit log answers what happened. Agent-008 answers why the agent was allowed to act. Every agent action carries a PAP that cites the original human instruction, the certified Root, the policy that authorized it, the secret handle that bound it, and the attestation that proves the agent had read its authorities. That is governance, not logging.
Eight independent layers of protection and accountability. Seven prevent: H33-Root (authority + intent), H33-Upstream (provenance), Agent-Zero (privacy-preserving operations), H33-Key (secret protection), TFHE (encrypted computation), Q-Sign (delegation governance), ZK-Verify (artifact verification). One proves: H33-74 — Layer 8 is the capstone, hosting PAP, NAP, verification, and replay. It turns every control the first seven run into something independently verifiable years later.
Yes. Agent-008 ships as a standalone Rust binary alongside h33-key and h33-attest. The terminal contract is agent-008 run --request <path>. An HTTP serve mode at 127.0.0.1:8777 lands when the integration with the runtime substrate completes.
The Agent-008 eight-layer storyboard runs at /demo/agent-008/. It walks the seven preventive layers and the H33-74 capstone, ending on the moment replay proves what the gate did.
No. The binary runs locally. Handles resolve locally. The gate is evaluated locally. The PAP is emitted locally. There is no cloud handshake, no telemetry, no shadow registration. The only network egress is whatever your agent itself makes to its target API.
The PAP is the artifact Agent-008 emits with every action. It carries the Root hash, the policy hash, the instruction citation, the Read Attestation, the Delegation Capsule, the secret handle reference, the freshness window, and the lifecycle state. Any third party can independently re-derive every binding and reach the same accept-or-deny verdict the runtime reached.
The Four Evaluators answer one of four orthogonal dimensions — Authority (can this entity decide?). Decision Integrity binds all four: Authority, Policy, Evidence, and Preconditions. A decision is only cleared when every dimension passes. If preconditions like OFAC freshness or KYC validity fail, the decision is blocked at the gate — never reaching the policy engine, never producing a PAP another team has to chase. The dimension that blocked is named on the response, alongside the artifact that would clear it.
Yes. Agent-008 is a standalone Rust crate. Path-dependencies on h33-key and h33-attest are version-pinned. Each crate has its own workspace; they build independently.
The Agent-008 demo walks every preventive layer — Root, Upstream, Agent-Zero, H33-Key, TFHE, Q-Sign, ZK-Verify — then closes on the H33-74 capstone: PAP, NAP, and the replay that proves what the gate did.
Open the demo at /demo/agent-008/ →Agent-008 composes them at the gate. You can run, audit, and replay every leg on its own.
Three views of the same product. What you get. What you'll pair it with. What runs underneath.
Every decision your AI agents make is independently verifiable — by you, by your auditor, by your customer, even years later, even if H33 disappears.
The H33 Governance Substrate · Root Lifecycle · Authority Transfer · Ratification Chain · Q-Sign threshold execution · Agent-Zero classification · Replay determinism