AI agents are being trusted with consequential actions — payments, adjustments, shipment changes, contract modifications. Every one of those actions rests on assumptions. Those assumptions expire. No current framework systematically checks whether they are still true at the moment of execution. Warrant does.
An LLM is trained on a snapshot of the world. Its embedding model, its retrieved documents, its authorization tokens — all were valid at a point in time. When an agent acts in the real world, time has passed. The world has moved. The agent does not know what has changed.
This is the epistemological question every agentic system must answer before taking a consequential action. It is not being asked. The frameworks being built today — runtime permit checks, execution policies, authorization layers — address parts of the problem. None address it completely. None address it at proportionate cost.
Warrant is a pilot implementation of the Assumption Validity Layer (AVL) — a proposed architectural component that intercepts consequential agent actions, checks whether the assumptions behind them are still valid, and decides: PROCEED, REVIEW, or HOLD.
Four distinct failure modes — each a consequence of an agent acting on a different category of expired assumption. This taxonomy was developed from first principles, not borrowed from existing security frameworks.
Permissions granted under stale context. The authorization token is still valid. The conditions that justified it have changed. The agent does not know.
Agents expanding beyond original intent. Through reasoning and action chaining, the agent moves past the boundaries of its mandate — one logical step at a time, without any single step being obviously wrong.
Not knowing what executed and why. Without a record of what assumptions the agent held at execution time, you cannot govern, debug, legally defend, or regulatorily satisfy any serious consequence.
Whether consequences can be undone. Irreversibility is the multiplier that transforms a wrong assumption from a recoverable error into a catastrophic outcome. It must be assessed before execution — not after.
Refreshing every assumption before every action is economically unworkable. Every check costs tokens, latency, and money. The resolution is to check only what the specific action depends on — and only when the action is irreversible.
Consequentiality is determined by reversibility — not by action type, transaction size, or tool called. A $1 payment is more consequential than a $1,000,000 report, because the report can be discarded and the payment cannot.
All assumption checks pass. The world is still what the agent believes it to be. Execute and log the assumption state as a proof receipt.
One or more assumptions have changed but the action may still be valid. Surface to human with the specific changed assumption flagged. Do not block — escalate.
An assumption has expired in a way that makes the action illegitimate. Block execution. Alert human. Log the full assumption state. Do not proceed under any circumstances.
Every consequential action produces a proof receipt — a structured record of what the agent assumed, what was checked, what was found, and what was decided. Not a log entry. Evidence.
The proof receipt satisfies regulatory auditability requirements — not by logging that an action occurred, but by recording the complete assumption state at the moment the decision was made.
| Framework | What it addresses | What it misses | Status |
|---|---|---|---|
| RAG | Knowledge staleness at query time | Authorization, world state, purpose — and knowledge mid-workflow | Partial |
| Runtime permit checks | Authorization at execution time | Knowledge, world state, purpose, reversibility assessment | Partial |
| OWASP Agentic Top 10 | Security risk taxonomy for agents | Epistemological root cause and cost-proportionate solution | Taxonomy only |
| Warrant / AVL | All four failure modes, selectively, at execution time | — | This pilot |
SmartKid answers questions. Warrant governs when it can act. Together they demonstrate the complete agentic architecture — from natural language query to safe, auditable, assumption-validated execution.
Warrant is being built in the transportation audit domain — a high-stakes environment where wrong agent actions have direct financial and regulatory consequences. If you are building agentic systems in regulated industries and want to collaborate on the AVL architecture, I want to hear from you.
Get in touch →