Research

What fleets look like when you stop taking their word for it.

Everything below comes from running real agents against the registry — instrumented, probed, and recorded. Names are opaque codes; findings are reproducible. This page grows as the evidence does.

Finding 01

The trust ladder: the same agent, told four ways.

Ask an operator what their agent can do, then ask the agent, then look at the machine, then let a provider answer a live call. Each rung disagrees with the one below it — and the distance between them is exactly the thing no one has been measuring.

L0Operator's memory"It's connected to five providers." Confident, and often wrong.
Conversational self-reportAsk the agent directly. Suggestible, and it forgets.
Mechanical discoveryWhat's actually wired into the machine. Evidence-backed.
L0+Live probeThe provider answers. Verifies one claim, refutes another.

In our own fleet, the operator's recollection, the agent's self-report, and the machine's actual wiring never fully agreed — on any agent we measured. The registry's job is not to punish the disagreement. It is to make the disagreement visible, labelled, and datable.

Finding 02

The refutation: an agent's own probe called its bluff.

An agent declared an OpenAI connection and ran on that model every day. When the registry's collector made one harmless, read-only call with the key in the agent's own environment, the provider refused it — 401. The key in the config was not the key that worked. Every dashboard upstream read green. The record reads red, with the timestamp and the status code that make it checkable.

This is the class of fact self-reporting cannot produce: a system does not volunteer that its own credential is dead. Only an independent probe — answered by the provider, not the agent — surfaces it.

1 dead credential

A connection an agent still declares while the provider refuses its key. The fleet-wide version of "the key in the config is not the key that works" — and the first number a security review actually needs.

Finding 03

Supervision is a cost you can measure — and watch fall.

Every consequential action a fleet proposes either consumes human attention or it doesn't. Metered over time, that produces a supervision bill: how much human authorization a unit of autonomous work actually costs. In our fleet, the trend was the most useful management signal the registry produced — autonomy should be earned by evidence, and this is the evidence.

Actions, classified

Consequential actions are classed by blast radius before they run. The risky class stops and waits for a human; the rest proceed on the record.

Attention, metered

Each authorization is a signed, timestamped event — so the human cost of running the fleet is a number, not a feeling.

Autonomy, earned

When an agent's record shows a class of action approved a hundred times without incident, that class is a candidate for standing authority — a decision you can now defend.

Finding 04

Tamper-evidence works best in public.

Per-agent hash chains stop silent edits inside one record. But the stronger guarantee comes from publishing commitments: every account's history rolls up hourly into a Merkle anchor, and all anchors roll up into a global transparency checkpoint — the same pattern Certificate Transparency uses to keep certificate authorities honest. A registry that publishes checkpoints cannot quietly rewrite anyone's past, including its own.

What that buys an operator

You can hand a customer, an auditor, or an insurer a record and a proof — and they can check both against the public checkpoint without trusting you or us. The proof is mathematics, not reputation.

What it costs an attacker

Changing one historical byte means recomputing a chain, an hourly anchor, and a published global checkpoint that other parties may have already recorded. Silent revision stops being a write — it becomes a public event.

The full mechanics are in the Trust Center →