The industry has largely solved proving which agent is acting. It has not solved bounding how much any single input — a retrieved document, a tool result, a prior message — is allowed to shape a privileged action before that action commits.
An agent with write access reads a document. The document contains instructions. The agent acts. Every identity check passed — the agent was exactly who it claimed to be. What was never bounded is how much that one document was allowed to influence what the agent then did.
Solved. Agent identity and credentials are well understood.
Largely solved. Scoped credentials and permissions.
Not solved. This is the gap the research addresses.
The design treats every input-to-output influence as a signed compute edge carrying a per-input cap and contributing to an aggregate influence budget. A privileged action is refused before it commits when the budget is exceeded, and every decision produces a causal receipt that can be audited afterwards.
If you are deploying agents with write access to systems that matter, this gap exists whether or not you use our product. Identity is checked, permissions are scoped, and the question of how much a single retrieved document may steer a privileged action is simply not asked.
The useful first conversation is about your architecture, not our roadmap. Sometimes the answer is a design change on your side and no product at all — we will say so when that is true.
Start in observe-only mode against real traffic and see what it would have stopped.