×
Airlock deploys observe-first: nothing below blocks an agent or gates an
engineer on day one. Enforcement is a dial
you turn once the data has earned it — with one deliberate exception:
fund-moving actions pass the resolution guard
from day one, because that boundary is where observation alone is not enough.
One event shape, every actor resolved
Airlock’s unit of record: an identity reached a resource, through a tool, on someone’s behalf. Humans, managed agents, and your in-house agents all land in the same store, in the same shape.- An agent reaches the network
- An agent retrieves a memo
- Your resolver reports a decision
market-resolver-7 — so an event claiming anyone else is
rejected, and every row carries a server-assigned received_at so backdating
is visible. An agent session is never just “the bot”: the record names who it
acted for. The full push contract is one page:
decision events.
The over-broad answer, after the fact
Consolidated knowledge means an agent can assemble an answer its requester was never cleared to see — the second event above already carried PII from an active case. Airlock does not block that request; it makes it reviewable within seconds of happening. What Josep opens is the session itself: the prompt, the documents the agent reached, the content it returned, and the person the session ran as. The conversation with the requester starts from a verbatim record rather than an accusation.Content-based alerting on access events isn’t built — access is logged in
enough detail to catch this on review, not to interrupt it. Alerting today
is limited to agent decisions. Which of these should fire
automatically, and on what, is exactly what a design partner would shape.
Resolution you can replay
The highest-stakes agent decision in the building: evaluate a real-world event, and funds move, across more markets than any human team can hand-check. The claim: no fund-moving action executes unless its stated evidence independently verifies against the market’s declared resolution source. Claims verified against sources. A resolution guard wraps the propose step. The resolver drafts an outcome with cited evidence; the guard independently re-fetches what was cited, runs its checks, and emits ALLOW or HOLD — only an ALLOW lets the separate submission backend run. Alongside it, every market produces a resolution evidence record, assembled before an outcome goes anywhere near the oracle: The record that gate produces — and the reply to any challenge raised in the oracle’s dispute window:resolution record RES-2026-0730-114 · complete
resolution record RES-2026-0730-114 · complete
What holds a proposal
Every check is a deterministic comparison against a source, a price, a number, or a status. This means that every HOLD arrives with a specific, auditable reason. All checks always run, and a proposal citing no evidence holds automatically:
The source of truth is not vendor-chosen. The market’s own rules text
declares its resolution source, and the guard’s source set derives from it
(per-category defaults cover markets whose rules name none). The network
enforces the same list during resolution — the
403 DENY above — so an
unapproved input does not quietly influence decisions.
Model output can classify, never authorize. Anything model-scored runs after the decision is final and
lands as an advisory. Every evaluation is appended to the audit log before
any backend runs.
Every ingested decision is checked as it arrives — no sources cited, low or
missing confidence, or two decisions on the same market that disagree — and
flagged ones reach the review queue before the
ingest request returns. Running two independent resolvers on the same markets
and letting disagreement catch the deltas costs nothing and shares no
failure mode.
The oracle clock is the deadline
Say that settlement runs through UMA’s optimistic oracle: an outcome is proposed with a bond behind it, and the dispute clock might run in hours. That window is why the record exists before the proposal — when a challenge lands, “stand or concede” is answered by reading the record rather than re-running the investigation against the clock. It works in reverse too: an externally proposed outcome that contradicts your agent’s evidence is a divergence finding, so the decision to dispute arrives documented.Smart-contract risk is the code-review and audit lane; the guard’s lane is
the agent layer above the contracts.
The deny log is the exfil story
For agents near sensitive infrastructure, observation isn’t enough. Agents in Airlock’s runtime sit on a network whose only route out is the proxy. Repos handling sensitive systems run it allowlist-first; ordinary development can run it as a blocklist so nobody waits on a policy edit, and the record is identical either way. This is what a prompt-injected exfiltration attempt looks like from the outside:Where it sits
Endpoint and network tooling watches machines. An agent assembling an answer from eleven internal documents on someone’s behalf is invisible to endpoint telemetry and ordinary as traffic — that layer is this product. It complements your stack rather than replacing it (events export cleanly to a SIEM).Self-hosted, verifiable
Runs in your VPC. No vendor telemetry, license checks offline, and the
backend’s own egress is an enumerated list you can read — with a live deny
log to prove it.
Evidence-grade by default
Insert-only history, server-assigned timestamps, hash-sealed captures,
legal holds, append-only export into your existing archive.
A pilot, visualized
1
Week one — onboard
Bundle in your VPC, team enrolled, in-house agents emitting to ingest (we
pair on the integration; it is the POST above). No enforcement, no
workflow changes. Your first artifact is the coverage report resolving every
enrolled identity, and which ones are producing no record.
2
Week two — watch
Point your resolution agents at the ingest API. Decision flags start
arriving with their evidence; your team evaluates them and tells us
what is noise. Interface with other Airlock features (exfil prevention, proxy, etc).
3
Data review
The record is the evaluation — what we caught, what we missed, what we
should watch next.