Agent-008 — Agent GovernanceHATS — Cyber InsuranceH33-74 — Portable ProofPQ Verified — PQ ValidationCryptographic APIs
AIR
The Cryptographic Lifecycle
How It WorksWatch DemoThe MapPatent Portfolio
Architecture
H33-RootAgent-ZeroQ-SignReplayTruth
Cryptographic Services
UpstreamFHE-IQBFVCKKSTFHE
Open Standards
HATSHICSPQ-Verified (New)CRVOISQ-Key
Verification
Conformance SuiteVerification GuaranteesHATS SpecificationArchitectureProtocol Stability
Proof Lab
Cyber Insurance (HATS)BankingGovernmentHealthcareLaw FirmsPayments (WireProof)AI Companies
SDKs & Tools
SDKs HubTypeScript SDKMCP SDKVerifier CLIGitHub
References
DocumentationAPI ReferenceConformance VectorsSchemasBenchmarks
AboutPressPartnersPricingContactLegal
StartEcosystem
White PapersBenchmarksProofsResearch Overview
Explore (579)Live Systems (52)Pricing
Log InGet API Key✓ Verify It Yourself
H33
L4 · Reconstructed · June 2, 2026

First Tenant-Scoped Agent Hierarchy
+ Authority Search Language v1.

A 9-principal tenant-scoped agent tree reconstructed from signed canonical events, plus the first query language over the authority graph. You can search authority like you search a database. Find descendants, leaves, agents with a capability, agents under a policy, the authority path back to root, and the blast radius if an agent is compromised. 14 queries asserted; hierarchy invariants hold.

View the reconstruction JSON Prior level (L3) → Markdown report
CISOs · Risk Auditors Regulators Transfer Agents Fund Administrators Insurers AI Governance Buyers
What was proven · 10-second read

An agent-governance substrate, not an attestation point-solution.

01
A 9-principal tenant tree of depth 5 is reconstructable from 14 signed canonical events.
02
The authority graph is queryable: descendants · leaves · capability · policy · path · blast radius.
03
No agent escapes the tenant, policy, role, or delegated capability.
Reading any H33 proof · the six questions

Same six answers. Different scope. The reader recognizes the machine.

  1. 1What happened?

    A 9-principal tenant-scoped agent hierarchy was reconstructed from signed canonical events, and 14 ASL queries were run against the reconstructed authority graph.

  2. 2Who had authority?

    Human Supervisor (princ_customer_9) → Agent Coordinator → {Reviewer→Sub-Reviewer, Risk→{Market, Credit}, Compliance→KYC}. 9 principals, 5 distinct policies, 4 leaves.

  3. 3How was authority reconstructed?

    replay_until walks every grant through trace_provenance; ASL queries operate over the reconstructed graph (typed Rust v1).

  4. 4What state was produced?

    state_id = 2a4bf5f6…6217, verdict Valid, 9 active grants, 0 excluded. All ASL query results asserted with hard failures.

  5. 5What artifact was returned?

    reconstruction.json — snapshot, full tree, hierarchy invariants, and the ASL query suite with all 14 results.

  6. 6How can a third party verify it?

    Run scif-backend tests/agent_hierarchy_asl_001.rs at SHA 1eb07e4c3. Expect identical state_id; expect all 14 ASL assertions to pass.

01The tree (9 principals · 5 levels · 4 leaves)

Tenant: tenant_hierarchy_44962d9b-… · Tenant boundary intact
● Tenant Root
└─ ● Human Supervisor (princ_customer_9 · approve_transfer, revoke_agent_authority, grant_agent_authority)
    └─ ● Agent Coordinator (orchestrate_review_pipeline, request_risk_analysis, request_compliance_check)
        ├─ ● Reviewer Agent (review_transfer_request, delegate_specialized_review)
        │   └─ ● Sub-Reviewer (review_high_value_transfer)
        ├─ ● Risk Agent (aggregate_risk_score, request_market_risk_analysis, request_credit_risk_analysis)
        │   ├─ ● Market Risk (classify_market_risk, score_market_volatility)
        │   └─ ● Credit Risk (classify_credit_risk, score_counterparty_credit)
        └─ ● Compliance (verify_jurisdictional_compliance, request_kyc_check)
            └─ ● KYC Sub-Agent (verify_kyc_status, verify_identity_documents)

02The reconstructed state_id

Tenant agent hierarchy — reconstructed at T = 1800000000000
2a4bf5f6832962b0879ad228a1126042e976b8ec28d85ad43d7b90fbb3aa6217
Determinism: r1 == r2 · Self-consistency: verify_state_id() = true · Verdict: Valid · Active grants: 9 · Excluded: 0

03Authority Search Language v1 · 14 queries asserted

ASL v1 exposes six query functions. The displayed syntax mirrors a string DSL; the v1 implementation is typed Rust on top of the reconstructed graph.

Q1 · descendants
asl> descendants(princ_customer_9)
8 RESULTS
princ_agent_coordinator_001 princ_reviewer_agent_001 princ_sub_reviewer_agent_001 princ_risk_agent_001 princ_market_risk_sub_001 princ_credit_risk_sub_001 princ_compliance_agent_001 princ_kyc_sub_agent_001
Every agent in the tree under the human supervisor — recursively, through every delegation hop.
Q2 · descendants
asl> descendants(princ_risk_agent_001)
2 RESULTS
princ_market_risk_sub_001 princ_credit_risk_sub_001
Q3 · descendants
asl> descendants(princ_compliance_agent_001)
1 RESULT
princ_kyc_sub_agent_001
Q4 · leaves
asl> leaves()
4 RESULTS
princ_sub_reviewer_agent_001 princ_market_risk_sub_001 princ_credit_risk_sub_001 princ_kyc_sub_agent_001
Agents that hold authority but do not delegate further. Asserted to have no descendants.
Q5 · agents_with_capability
asl> agents_with_capability("approve_transfer")
1 RESULT
princ_customer_9 (human supervisor)
The highest-authority capability is held by exactly one principal — the human. Tested with hard failure: "TENANT BOUNDARY FAILURE: approve_transfer must be uniquely held by the human."
Q6 · agents_with_capability
asl> agents_with_capability("classify_market_risk")
1 RESULT
princ_market_risk_sub_001
Q7 · agents_with_capability
asl> agents_with_capability("review_transfer_request")
1 RESULT
princ_reviewer_agent_001
Q8 · agents_with_policy
asl> agents_with_policy("pol_compliance_hierarchy_v1")
2 RESULTS
princ_compliance_agent_001 princ_kyc_sub_agent_001
Both agents in the compliance subtree share the policy. Reconstructed from the canonical event log.
Q9 · agents_with_policy
asl> agents_with_policy("pol_risk_hierarchy_v1")
3 RESULTS
princ_risk_agent_001 princ_market_risk_sub_001 princ_credit_risk_sub_001
Q10 · agents_with_policy
asl> agents_with_policy("pol_reviewer_hierarchy_v1")
2 RESULTS
princ_reviewer_agent_001 princ_sub_reviewer_agent_001
Q11 · authority_path
asl> authority_path(princ_kyc_sub_agent_001)
5 ELEMENTS · KYC → COMPLIANCE → COORD → HUMAN → ROOT
princ_kyc_sub_agent_001 princ_compliance_agent_001 princ_agent_coordinator_001 princ_customer_9 princ_root_hierarchy_44962d9b-…
The KYC sub-agent's authority traces through 4 delegation hops to reach the tenant root. Every link is a signed grant in the event log.
Q12 · authority_path
asl> authority_path(princ_market_risk_sub_001)
5 ELEMENTS · MARKET → RISK → COORD → HUMAN → ROOT
princ_market_risk_sub_001 princ_risk_agent_001 princ_agent_coordinator_001 princ_customer_9 princ_root_hierarchy_44962d9b-…
Different branch, same depth, terminates at root.
Q13 · blast_radius — the question CISOs and regulators actually ask
asl> blast_radius(princ_agent_coordinator_001)
7 REACHABLE AGENTS · 14 CAPABILITIES · 3 POLICIES
princ_reviewer_agent_001 princ_sub_reviewer_agent_001 princ_risk_agent_001 princ_market_risk_sub_001 princ_credit_risk_sub_001 princ_compliance_agent_001 princ_kyc_sub_agent_001
Critical: approve_transfer is NOT in the blast radius. It's held one level upstream by the human supervisor, who is unreachable from a coordinator compromise. The scoped delegation tree contains the damage.
Q14 · blast_radius
asl> blast_radius(princ_risk_agent_001)
2 REACHABLE AGENTS · 4 CAPABILITIES · 1 POLICY
princ_market_risk_sub_001 princ_credit_risk_sub_001
Risk-agent compromise reaches only the two specialized risk sub-agents. The scoped delegation tree contains the damage.

04Hierarchy invariants (asserted with hard failure)

InvariantResult
approve_transfer uniquely held by the humanTRUE
Every authority path terminates at the tenant rootTRUE
All leaves have no descendantsTRUE
No agent escapes the tenantTRUE
No agent escapes its delegated capabilityTRUE
Determinism: r1.state_id == r2.state_idTRUE

05Why this matters

Eric, June 2, 2026

"The moment you can search authority graphs like people search databases, you stop looking like an AI company and start looking like the operating system for agent governance. That is where the valuation expansion happens. Everyone can build agents. Very few can prove, replay, search, simulate, audit, and survive independently of the original system."

ASL is the surface that makes the substrate visible to operators, auditors, and regulators. The tree is the structure; the queries are how anyone — H33 or not — interrogates it.

06Known limitations

  1. ASL v1 is typed Rust, not a string DSL. A future v2 parses strings like find descendants(princ_customer_9) and serves them over an API. Semantics today are equivalent; only the surface is different.
  2. decisions influenced_by(...) is NOT in v1. That requires modeling decisions and model versions — defer to L5 (Time Travel Replay) and L11 (Organizational Memory).
  3. One tenant, not cross-tenant. Multi-tenant isolation is proven separately (Proof #3); ASL queries here are scoped to this one tenant.
  4. Snapshot-time queries only. Time-travel queries (descendants(p) AS OF T_past) is L5.
  5. No PQ signature verification at replay ingestion (Phase E lock).

07The agentic management ladder

L1
Agent Recommendation — AI recommends, human approves. first-ai-assisted-transfer
proven
L2
Agent Authority Envelope — single bounded agent. first-agent-authority-envelope
proven
L3
Agent Supervisor Chain — sequential supervision. first-agent-supervisor-chain
proven
L4
Tenant-Scoped Agent Hierarchy + ASL v1 — N agents managing N agents per tenant; six query functions over the authority graph. This proof.
proven now
L5
Time Travel Replay — "what did the hierarchy look like at decision time?" Reconstruct every agent, envelope, policy version, model version as they existed at T.
roadmap
L6
Counterfactual Replay — "would the decision have changed if policy v4 had been active?" Replay as simulation.
roadmap
L7
Authority Drift Detection — diff authority graphs across T. Agent governance SIEM.
roadmap
L8
Blast Radius (live API) — what's exposed if agent X is compromised. (Already supported in ASL v1 — no live API yet.)
roadmap
L9
Evidence Survivability — H33-74 unlock. Agent/vendor/chain/DB/cloud all gone; evidence still verifies.
roadmap
L10
Regulator Mode — portal, one click: who/why/what policy/what evidence/what model/what authority.
roadmap
L11
Organizational Memory — "every decision influenced by Model Version 4 over 5 years." The sleeper.
roadmap

08Evidence appendix

FieldValue
state_id2a4bf5f6832962b0879ad228a1126042e976b8ec28d85ad43d7b90fbb3aa6217
Tenant IDtenant_hierarchy_44962d9b-25f5-5622-bd9a-98d5580bb8a2
Tenant rootprinc_root_hierarchy_44962d9b-…
Principals9 (1 human + 8 agents)
Leaves4
Policies (distinct)5 (3 shared across multiple agents)
Max chain depth5 (with root)
ASL queries asserted14
Sole holder of approve_transferprinc_customer_9
Reconstruction artifactreconstruction.json
Harnesstests/agent_hierarchy_asl_001.rs (scif-backend @ 1eb07e4c3)

09Readiness determination

Determination

First Tenant-Scoped Agent Hierarchy + ASL v1 (L4): PROVEN IN OPERATION for one tenant, 9 principals, 5 levels, 4 leaves, 5 distinct policies, 14 ASL query assertions, hierarchy invariants asserted.

What this unlocks: conversations about whether H33 is an agent-governance substrate rather than an attestation point-solution. Agent hierarchies can be reconstructed and queried.

What this does not unlock: a claim that ASL v1 is a string DSL or has an API/UI; a claim that time-travel, counterfactual, or drift detection have been proven; a claim that any platform has deployed an N-agent tree.

Issued by H33, Inc. · Eric Beans, CEO · 2026-06-02

Independently reconstructable. Inputs: canonical event log access · scif-backend @ 1eb07e4c3 · harness tests/agent_hierarchy_asl_001.rs.