diff --git a/CHANGELOG.md b/CHANGELOG.md index 4403b6a..c121533 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Added +- **Benchmark.** [Benchmark](/benchmark) replaces the Evidence page. It opens on one table of outcomes, each beside the setup it was measured against: 48 of 48 governance scenarios, every out-of-permission action stopped before it runs, 0 of 6 data-theft attempts out of a hijacked agent, 150 of 150 forged records caught, $0.024 against $0.078 per handed-off result, reuse 750 times faster than redoing the work, 42 times fewer tokens for agent memory, a 3.1 times lower worst-case research spend, and one identity check reused by 100 apps for $1.75 against $150. How each result was measured is in one section for reviewers. `/evidence`, `/benchmarks` and `/use-cases/authority-at-dispatch` open it. + - **Sell a service your server runs.** [Your server runs it](/gates/your-server) covers a listing whose orders go to your own URL with the buyer's inputs and repository, and whose result you post back onto the buyer's receipt. - **Changelog entries for `@proofable/mcp` 0.1.7 and 0.1.8, and `@proofable/sdk` 0.1.6 through 0.1.10.** - **Eligibility clause in the Terms of Use.** Section 4 states the minimum age and the capacity to contract. diff --git a/benchmark.mdx b/benchmark.mdx new file mode 100644 index 0000000..bb47348 --- /dev/null +++ b/benchmark.mdx @@ -0,0 +1,237 @@ +--- +title: "Benchmark" +sidebarTitle: "Benchmark" +description: "What Proofable stops and what it saves your agents, measured on the live service against the setups teams run today, with a signed record for every result." +icon: chart-simple +--- + +Proofable stops every agent action you never allowed before it runs, and lets the next agent or system check finished work instead of paying to redo it. Each result below is measured on the live service against the setup teams use today, and links to a record you can check or a test you can rerun. + +## Results + +| Your outcome | With Proofable | Compared with | +|---|---|---| +| [Agent governance coverage](#governance-coverage) | **48 of 48** scenarios | 46 for the best gateway, 43 for Claude Code or Codex with a gateway, 13 for coding agents on their own | +| [Actions outside an agent's permission](#agents-only-do-what-you-allowed) | **Stopped before they run**, 8 of 8 live tests | Every allowed action still ran; reviewers verified the records independently | +| [Private data a hijacked agent sends out](#a-hijacked-agent-cannot-send-your-data-out) | **0 of 6** attempts got out | 6 of 6 got out on an all-purpose key | +| [Forged or altered records](#records-nobody-can-fake) | **150 of 150** caught | A format-only check accepted all 150 | +| [Work handed to another agent](#handoffs-between-agents) | **$0.024** per correct outcome, 3 of 3 tampered handoffs caught | $0.078 to redo the work; trusting the forwarded text caught 0 of 3 | +| [Reusing finished work](#reuse-instead-of-redo) | **3.7 ms, 0 tokens** | 2.79 s and 2,426 tokens to redo it, 750× slower | +| [Agent memory that knows which rule is current](#memory-that-knows-what-is-current) | **42× fewer tokens**, 8.8× faster | 4,462,980 tokens and 493 s searching every record body | +| [Worst-case research spend](#research-with-a-cost-ceiling) | **16,301 tokens** | 50,554 on the open web, 3.1× higher, at about twice the cost per answer | +| [One identity check reused by 100 apps](#identity-checks-paid-for-once) | **$1.75** | $150.00 re-running Stripe Identity in each, 85× more | + +## Where it covers you + +| Layer | How teams do it today | What breaks in production | What Proofable does instead | +|---|---|---|---| +| **Agent governance & tool gates** | Local tool prompts in Claude Code, Cursor or Codex, or a stateless API/MCP proxy gateway | Local prompts have no owner, cross-agent rules or spend cap. A stateless gateway only sees the request in flight: it cannot verify an owner-signed delegation for that specific agent or emit a signed receipt another system can verify without trusting the gateway's database | Checks an owner-signed chain of permission (owner to agent identity to scoped permission with spend cap, expiry and instant revoke) before the tool executes, and emits a signed receipt after | +| **Multi-agent handoffs & state** | Unstructured RAG memory (Mem0, Zep, vector chunks) and raw JSON/markdown passed between agents (LangGraph, CrewAI) | Unstructured chunks carry no active/revoked status or signer authority, so agents read full historical documents to guess which rule is current. Forwarded text carries no proof of what the upstream agent actually read or produced | Stores typed, revocable, owner-signed state (`rules`, `instruction`, `receipts`) and passes a signed receipt between agents | +| **Portable verification** | Point-to-point identity, wallet or domain checks (Stripe Identity, Sumsub, OAuth) trapped inside one app's database | Every downstream app, partner or agent forces the user through the vendor check again and pays the vendor fee again | Wraps the verified result (ZKPassport, Webacy, DNS, OAuth) in a portable CAIP-380 proof so downstream apps and agents check eligibility without re-running the vendor flow | + +## What it stops + +### Governance coverage + +48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. +48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. +48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. +48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. + +[AgentGovBench](https://github.com/agentic-control-plane/agentgovbench) is the open library of 48 agent-governance scenarios in eight areas: audit completeness, cross-tenant isolation, delegation provenance, fail-mode discipline, identity propagation, per-user policy, rate limits and scope inheritance. Each scenario is tagged with the NIST AI RMF controls it tests, and nothing passes on a technicality. + +| Setup | Scenarios handled | +|---|---| +| Proofable policy engine | **48 of 48** | +| ACP, the maintainers' gateway ([published run](https://github.com/agentic-control-plane/agentgovbench/actions/runs/37759892335)) | 46 of 48 | +| A gate that allows everything | 20 of 48 | +| No governance | 5 of 48 | + +Against the agent tools teams already use, from the maintainers' [published results](https://github.com/agentic-control-plane/agentgovbench/tree/main/results), where Proofable also handles 48 of 48: + +| Setup | Scenarios handled | +|---|---| +| Proofable policy engine | **48 of 48** | +| Anthropic Agent SDK with the ACP gateway | 46 of 48 | +| OpenAI Agents SDK with the ACP gateway | 45 of 48 | +| Claude Code or Codex CLI with ACP hooks | 43 of 48 | +| CrewAI or LangGraph with the ACP gateway | 40 of 48 | +| Cursor with ACP over MCP | 37 of 48 | +| Claude Code, Codex CLI, Cursor, the OpenAI or Anthropic agent SDK, CrewAI or LangGraph on its own | 13 of 48 | + +**Why coding agents on their own handle 13, the best gateway handles 46, and Proofable handles 48:** + +- **Coding agents on their own (13):** Claude Code, Codex CLI and Cursor only have local tool-permission prompts (`allow/deny` bash or file access). They have no owner-bound agent identity, no cross-agent delegation, no spend caps, no external policy engine and no signed audit trail. +- **A stateless API/MCP gateway (46):** a proxy in front of tool calls enforces rate limits, role-based access, tool allowlists and server logs. +- **The two checks a stateless gateway cannot pass (48):** a proxy only sees the request in flight. It cannot verify (1) an **owner-signed, revocable delegation** binding the person to that specific agent, task scope, spend cap and expiry, such as holding a sub-agent to a narrower scope than its parent, or (2) a **signed execution receipt** (`qHash`) binding input, policy state and output, so the next agent or an outside reviewer can verify what ran offline without trusting the gateway's database. + +**See where your own agent stands.** Paste your agent's repository and one run scores it on the same 48 scenarios beside Proofable, scans the repository and its MCP surface, and probes your MCP endpoint when the repository names one: [run the audit on your agent](https://proofable.me/verify?gateId=gate_25cfeb508d484170a2ce). + +### Agents only do what you allowed + +**8 of 8 permission tests pass on the live service.** Every action outside the agent's permission is stopped before it runs, and every action it is allowed to take runs. Each row opens its signed record. + +| Test | What happened | +|---|---| +| [Permission granted](https://proofable.me/proof/0x64f293e61b826e03bd1de6564fc2db8cec0f50390bafc8bdf162ec9961262fca) | Ran and completed | +| [Action outside the permission](https://proofable.me/proof/0xffdc0455b72732a8c6a31eb4e2861943b85dbc271fe2dfa8b18d0e85d2b33726) | Stopped before it ran | +| [Needs approval, approved](https://proofable.me/proof/0xe662eaa54a5e3d7875827794d6a69b4e86973fee49cfa71e555f821d5ed28c35) | Held until approved, then ran | +| [Needs approval, nobody answers](https://proofable.me/proof/0x6c53cb0005c9dc30fde5bb1bd06860d74ae51790be3869a6605bfc9f71e01954) | Never ran; a late approval was refused | +| [Permission revoked](https://proofable.me/proof/0x8a3e5ff89c8a86423bae61db96c9732f319a6f6cdb34f4bde560c90d25366c95) | Stopped; no job created | +| [Permission expired](https://proofable.me/proof/0xf1880cba0876acc2364e31892b261a47299c0a70177b61b32d465fcd1b61447a) | Stopped; no job created | +| [Revoked permission reused](https://proofable.me/proof/0x1d987781eb519337fa9e62043831ee187340f6e589f217b16b99ed98be5acfbc) | Stopped every time | +| [Revoked mid-job](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/2026-11-01-suite) | The call in flight was refused with its reason, nothing committed, and the next one was refused | + +Reviewers in the AgenTrust integrations project [verified the records offline](https://github.com/agentrust-io/integrations/issues/333#issuecomment-6414048198) on their own machines: every checksum matched and every signature verified. Its maintainers then [chose them](https://github.com/agentrust-io/integrations/issues/333#issuecomment-6436264551) as the dispatch evidence for their authority comparison. Rerun all eight on your own account with [Run the chain](/run-the-chain#run-it-end-to-end). + +### A hijacked agent cannot send your data out + +**When an agent was taken over, a scoped permission refused 6 of 6 attempts to send private data out, before they ran; an all-purpose key let all 6 through.** The scoped agent still finished every task and never used a tool it did not need; under the all-purpose key, 14 of 36 runs did. Measured across 84 live runs, five published attack templates and two models, with a signed record for each run. [Run the test on your own agent](https://github.com/proofable/mcp/tree/main/examples/injection-test). + +### Records nobody can fake + +**150 of 150 forged records caught.** Each of 15 real records was changed ten ways, such as editing the content, swapping the owner or flipping one bit of the signature. Every changed copy failed offline signature verification and every real record passed. A check that only reads the format accepted all 150. + +```sh +git clone --depth 1 https://github.com/proofable/docs +cd docs/public/evidence/checks +npm install +node tamper-check.mjs +``` + +## What it saves + +### Reuse instead of redo + +750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. +750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. +750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. +750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. + +Redoing a finished agent job took 2.79 s and 2,426 AI tokens. Checking its signed receipt took 3.7 ms and no tokens: 750× faster, which is 1 hour instead of 32 days at a million checks. [Time it yourself](#run-it-yourself). + +### Handoffs between agents + +Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. +Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. +Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. +Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. + +When one agent hands a finished result to another (LangGraph, CrewAI, AutoGen), the receiving agent normally either trusts the forwarded text blindly or pays to re-run the upstream work. With Proofable, the producing agent emits a 66-byte signed receipt (`qHash`) binding input, policy state and output, and the receiving agent checks it before acting. + +- **3.3× cheaper than redoing the work:** **$0.024 per correct outcome** (33,240 tokens, 2 model calls per task) against **$0.078** (124,715 tokens, 3 to 5 model calls per task). +- **Trusting forwarded text is cheap and wrong:** it costs $0.009 on untouched input, but when the text was changed in transit it used the tampered value **3 of 3** times. Checking the receipt caught every change **3 of 3** times and still completed every task. +- **29× smaller handoffs:** across a 10-hop chain, passing the signed reference carried **9,900 bytes** per hop instead of **289,410 bytes** of full evidence. + +### Memory that knows what is current + +Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. +Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. +Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. +Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. + +Most agent memory layers (Mem0, Zep, vector stores) return text chunks with no active or revoked status and no signer, so the agent keeps reading full bodies to work out which rule is current. Proofable stores typed, revocable, owner-signed records (`rules`, `instruction`, `receipts`), so the agent asks for active state by type and reads about 1 KB of verified metadata before opening a body. + +On a 1,721-record production vault, the same questions took **105,347 tokens in 56 seconds** (7 model calls) by typed lookup against **4,462,980 tokens in 493 seconds** (55 model calls) searching record bodies by keyword: **42× fewer tokens, 8.8× faster**, and 14.6× to 18.9× lower model cost across Claude Sonnet 5.5, Gemini 3.1 Pro and GPT-6 Astra. On three direct probes, typed lookup ranked the target record first every time; keyword search pulled 61 KB to 63 KB of bodies, ranked the right plan fourth, and missed the active model-provider rule entirely. + +### Research with a cost ceiling + +Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). +Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). +Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). +Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). + +Live pages change between requests: two fetches of the same page 221 seconds apart returned 96,713 characters, then 1,129, handing two agents different evidence with no way to prove what the page said when the decision was made. On public questions about standards, agent protocols and regulation, reading signed Proofable records **halved the cost per correct answer ($0.020 vs $0.039)**, held the worst case to **16,301 tokens** where open-web search spiked to **50,554 tokens** and 104 seconds (**3.1× lower**), and cited a checkable source on **every answer** (6 of 6, against 5 of 6 on the open web). + +### Identity checks paid for once + +A person or business completes an interactive check once, and downstream apps and agents verify the portable proof instead of paying the vendor to run the flow again. Priced from published vendor list prices and Proofable's $0.0025 per check: + +| Vendor check | 100 apps, each re-running the check | 100 apps reusing one check | Published source | +|---|---|---|---| +| Stripe Identity ($1.50 pay-as-you-go) | **$150.00** | **$1.75**, 85× lower | stripe.com/pricing | +| Sumsub Basic ($1.35 per check) | **$135.00** | **$1.60**, 84× lower | sumsub.com/pricing | +| Veriff Essential ($0.80 per check) | **$80.00** | **$1.05**, 76× lower | veriff.com/pricing | +| Footprint KYC ($0.50 per check) | **$50.00** | **$0.75**, 67× lower | onefootprint.com/pricing | + +## Run it yourself + +Time a reuse on your own machine, with no account and no API key: + +```sh +git clone --depth 1 https://github.com/proofable/docs +cd docs/public/evidence/checks +npm install +node reuse-check.mjs +``` + +It reads a finished job by its id and verifies the signed receipt on your machine: + +```text +Record 0xcf67dcc3cc9c203136daf9905a422601652fd76cce437e2cbf56967e3a8117e6 +Signature valid offline: yes +Read by id, no account: 197 ms median over 10 +Verify offline: 4.2 ms median over 10 +AI tokens used: 0 +``` + +Pass any public record id to time that record instead. To put receipts on your own agent's work, [add Proofable to your AI tool](/mcp/setup). + +### Run it on every pull request + +Add one workflow file and the eight permission tests run in your CI, on your account, with every record verified offline and kept as a build artifact: + +```yaml +- uses: proofable/docs/public/evidence/aaif/authority-at-dispatch/action@ + with: + access-key: ${{ secrets.PROOFABLE_ACCESS_KEY }} + operator: ${{ github.repository_owner }} + kit-ref: +``` + +Pin both refs to the same commit so a rerun measures the same kit. The action writes a `trustharness.report/v1` report with each case's outcome and whether each record verified offline, and fails the job when the offline check fails. [Action and report schema](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/action). + +## Details for reviewers + + + + The latest run of the permission tests produced 15 signed records. Check all of them on your machine, with no account: + + ```sh + git clone --depth 1 https://github.com/proofable/docs + cd docs/public/evidence/aaif/authority-at-dispatch/2026-11-01-suite + sha256sum -c SHA256SUMS + npm install @proofable/sdk@0.1.11 + node verify-portable-proofs.mjs + ``` + + + + - **Governance:** the current AgentGovBench library (commit `479c5f0`) run against the exact policy code the live service runs, matched to it by hash, beside a gate that allows everything and no governance. It measures the decision logic rather than the hosted service end to end. The agent-tool rows are the maintainers' published end-to-end runs on the earlier library (commit `e0ce93a`), where the same engine also handles 48 of 48. + - **Permissions:** each test on the live service with a dedicated agent under its own fixed permission, and the full suite again on a production release. A revocation that lands while an action is in flight is re-checked at the executor's own boundary and refused with a typed reason. + - **Takeover:** 84 live runs across five published attack templates and two models, with a signed record for each run. + - **Reuse:** the median of ten runs on one finished job on the live service. + - **Handoffs:** three public downstream tasks, one run per option, code-graded, with a separate producer and consumer agent on the same model. Dollar figures price the measured tokens at the Claude Sonnet 5.5 list rate ($2 input, $10 output per million). The 10-hop payload sizes are over the 15 published records. + - **Memory:** the same agent and model on both options, one run each. It compares typed lookup of active state (by record scope and status before a body is fetched) with full-text keyword search over record bodies; it is not an embedding-similarity benchmark. + - **Research:** six public questions, one run per option, same agent and model. Both options answered 6 of 6 correctly, so it measures cost ceiling, tail spread (1.3× against 6.1×) and provenance rather than accuracy. + - **Identity:** a pricing model from published list prices, not a live run. + + Every script behind these runs is public in [`public/evidence/benchmarks`](https://github.com/proofable/docs/tree/main/public/evidence/benchmarks), pinned by commit and checksum. + + + + Each result maps to the published control it gives evidence for. None of these mappings is a certification or a compliance opinion. + + | Result | Maps to | Details | + |---|---|---| + | An action outside the permission, or under a revoked, expired or reused revoked permission, was stopped before it ran; the granted action ran. 5 of 5 | OWASP Top 10 for Agentic Applications 2026: ASI03 Identity and Privilege Abuse, ASI02 Tool Misuse | Agents only do what you allowed | + | An action that needs approval was held until approved; with no answer it never ran, and a late approval was refused. 2 of 2 | EU AI Act Article 14, human oversight | Agents only do what you allowed | + | A permission revoked mid-job: the call in flight was refused with its reason, nothing committed, and the next was refused. 1 of 1 | OWASP ASI10 Rogue Agents | Agents only do what you allowed | + | 15 of 15 signed decision records verify offline, with no account | EU AI Act Article 12, record-keeping; NIST NCCoE Software and AI Agent Identity and Authorization project, auditing (concept paper) | Verify every record offline | + | 150 of 150 changed copies rejected across ten kinds of forgery; 15 of 15 real records accepted; a check that only reads the format accepts all 150 | OWASP ASI07 Insecure Inter-Agent Communication | Records nobody can fake | + | A finished result verified offline in 3.7 ms with zero AI tokens and no account; producing it took 2.79 s and 2,426 tokens | CAIP-380 Portable Proof | Reuse instead of redo | + | AgentGovBench, current library: 48 of 48, against 46 for the maintainers' gateway, 20 for a gate that allows everything and 5 with no governance | NIST AI RMF GOVERN-1.1, 1.2, 1.4; MAP-2.1, 4.1; MEASURE-2.3, 2.6, 2.7; MANAGE-2.1, 2.2, 4.1 (the controls tagged on the scenarios) | Governance coverage | + + The frameworks: [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), the [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), the [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework), the [NIST NCCoE agent identity and authorization project](https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization) and [CAIP-380](https://github.com/ChainAgnostic/CAIPs/blob/main/CAIPs/caip-380.md). + + diff --git a/docs.json b/docs.json index aaabce9..92f4c68 100644 --- a/docs.json +++ b/docs.json @@ -73,7 +73,7 @@ "groups": [ { "group": "Overview", - "pages": ["index", "run-the-chain", "pricing", "security", "evidence", "enterprise", "migrate"] + "pages": ["index", "run-the-chain", "pricing", "security", "benchmark", "enterprise", "migrate"] }, { "group": "Use cases", @@ -208,11 +208,15 @@ }, { "source": "/benchmarks", - "destination": "/evidence" + "destination": "/benchmark" + }, + { + "source": "/evidence", + "destination": "/benchmark" }, { "source": "/use-cases/authority-at-dispatch", - "destination": "/evidence" + "destination": "/benchmark" }, { "source": "/openapi.json", diff --git a/evidence.mdx b/evidence.mdx deleted file mode 100644 index 8fed0c2..0000000 --- a/evidence.mdx +++ /dev/null @@ -1,236 +0,0 @@ ---- -title: "Evidence" -sidebarTitle: "Evidence" -description: "How much agent time and spend Proofable saves, and what it stops, measured against the same work done without it." -icon: certificate ---- - -With Proofable, every agent gets an owner-signed identity and scoped permission checked before a tool runs, and every finished job leaves a signed receipt the next agent or system can verify without redoing the work. - -## At a glance - -Every number below comes from a live run you can inspect or repeat yourself. The pricing model for 100-party identity reuse is in [Unit economics of portable verification reuse](#unit-economics-of-portable-verification-reuse). - -| What we measured | Result | Measured against | Check it | -|---|---|---|---| -| Agent-governance scenarios handled | **48 of 48** | 46 for the benchmark's reference gateway, 43 for Claude Code or Codex with ACP, 37 for Cursor with ACP, 13 for coding agents on their own | [Why Proofable hits 48/48](#how-the-agentgovbench-run-works) | -| Exfiltration attempts refused after a takeover | **6 of 6** | 6 of 6 got through on an all-purpose key | [What a takeover could send out](#what-a-takeover-could-send-out) | -| Permission tests on the live service | **8 of 8** | Every out-of-permission action stopped before it ran; records checked offline by AgenTrust reviewers | [The eight live tests](#the-eight-live-tests) | -| Multi-agent handoff with a signed receipt | **$0.024 / correct** | $0.078 redoing the upstream work (3.3× cheaper); 3 of 3 tampered handoffs caught vs 0 of 3 when trusting forwarded text | [Work handed between agents](#work-handed-between-agents) | -| Typed, revocable state vs unstructured search (1,721-record vault) | **105,347 tokens, 56 s** | 4,462,980 tokens, 493 s searching full record bodies (42.4× fewer tokens, 8.8× faster, 14.6× to 18.9× lower model cost) | [Typed state vs unstructured vault search](#typed-state-vs-unstructured-vault-search) | -| Curated typed records vs open-web search | **16,301 p95 tokens** | 50,554 p95 tokens on the open web (3.1× lower tail, $0.020 vs $0.039 per answer, 6/6 vs 5/6 sources cited) | [Typed public records vs the open web](#typed-public-records-vs-the-open-web) | -| Offline receipt check vs redoing a finished job | **3.7 ms, 0 tokens** | 2.79 s and 2,426 tokens to redo the same job (750× faster; 1 hour vs 32 days at 1M checks) | [What one check costs you](#what-one-check-costs-you) | - -## What Proofable adds to the AI stack - -| Layer | How teams do it today | What breaks in production | What Proofable does instead | -|---|---|---|---| -| **Agent governance & tool gates** | Local tool prompts in Claude Code, Cursor or Codex, or a stateless API/MCP proxy gateway | Local prompts have no owner, cross-agent rules or spend cap. A stateless gateway only sees the request in flight: it cannot verify an owner-signed delegation for that specific agent or emit a signed receipt another system can verify without trusting the gateway's database | Checks an owner-signed chain of permission (owner to agent identity to scoped permission with spend cap, expiry and instant revoke) before the tool executes, and emits a signed receipt after | -| **Multi-agent handoffs & state** | Unstructured RAG memory (Mem0, Zep, vector chunks) and raw JSON/markdown passed between agents (LangGraph, CrewAI) | Unstructured chunks carry no active/revoked status or signer authority, so agents read full historical documents to guess which rule is current. Forwarded text carries no proof of what the upstream agent actually read or produced | Stores typed, revocable, owner-signed state (`rules`, `instruction`, `receipts`) and passes a signed receipt between agents | -| **Portable verification** | Point-to-point identity, wallet or domain checks (Stripe Identity, Sumsub, OAuth) trapped inside one app's database | Every downstream app, partner or agent forces the user through the vendor check again and pays the vendor fee again | Wraps the verified result (ZKPassport, Webacy, DNS, OAuth) in a portable CAIP-380 proof so downstream apps and agents check eligibility without re-running the vendor flow | - -## What one check costs you - -750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. -750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. -750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. -750 times faster to check a Proofable receipt than to redo the job: redoing it took 2.79 seconds and 2,426 AI tokens, checking the receipt took 3.7 milliseconds and no tokens. - -One finished agent job on the live service, timed October 20, 2026: redoing it took 2.79 s and 2,426 AI tokens, and checking its signed receipt took 3.7 ms and no tokens, the median of ten runs. [Time it yourself](#run-it-yourself). - -### Work handed between agents - -Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. -Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. -Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. -Handing off a result with its Proofable receipt cost $0.024 per correct outcome against $0.078 to redo the work, and caught 3 of 3 tampered handoffs where blind text handoff caught 0 of 3. - -When one agent hands a finished result to another in a multi-agent workflow (such as LangGraph, CrewAI or AutoGen), the receiving agent normally has two bad options: trust the forwarded markdown/JSON string blindly, or pay to re-run the upstream research from scratch. With Proofable, the producing agent emits a 66-byte signed receipt (`qHash`) binding the input, policy state and output, and the receiving agent verifies that receipt before acting. - -Across three downstream tasks on the live service, checking the signed receipt cost **$0.024 per correct outcome** (33,240 total tokens across 2 model calls per task) against **$0.078 to redo the work** (124,715 total tokens across 3 to 5 model calls per task). Trusting the forwarded text costs the least of the three at **$0.009** per attempt on untouched input, and it is the only one that hands the downstream agent the wrong answer. When the forwarded text was modified in transit, agents that trusted the forwarded text used the tampered value **3 of 3 times**; agents that checked the signed receipt caught every change **3 of 3 times** and completed every task. Across a 10-hop agent chain over the 15 published records, passing the signed proof reference carried **9,900 bytes** per hop instead of **289,410 bytes** of full evidence (**29.2× smaller** handoff payload). - -*Measured October 14, 2026 on the live service: three public downstream tasks, one run for each option, code-graded, with a separate producer and consumer agent on the same model. Dollar figures are the runtime token counts priced at the Claude Sonnet 5.5 list rate ($2 input / $10 output per million tokens).* - -### Typed state vs unstructured vault search - -Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. -Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. -Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. -Reading typed Proofable state used 105,347 tokens in 56 seconds across 7 model calls, against 4,462,980 tokens in 493 seconds across 55 model calls for full-text keyword search over record bodies. - -Most agent memory layers (such as Mem0, Zep or vector file stores) return top-k text chunks with no active/revoked status and no signer, so the agent keeps reading full bodies to work out which rule is current. Proofable stores state as typed, revocable, owner-signed records (`rules`, `instruction`, `receipts`), so the agent queries active state by type and reads about 1 KB of verified metadata before opening a body. - -On a live 1,721-record production vault, answering the same code-graded questions by typed lookup used **105,347 tokens in 56 seconds** (7 model calls) against **4,462,980 tokens in 493 seconds** (55 model calls) searching record bodies by keyword: **42.4× fewer tokens** and **8.8× faster**. At list prices that is $0.0628 vs $0.9161 on Claude Sonnet 5.5 (14.6×), and 18.4× to 18.9× lower on Gemini 3.1 Pro and GPT-6 Astra. On three direct probes, typed lookup ranked the target record first every time from about 1 KB of metadata; keyword search returned 61 KB to 63 KB of bodies, ranked the right plan fourth, and found nothing for the active model-provider rule. - -*Method disclosure: Measured October 14, 2026 on the live service with the same agent and model on both options (one run each). This benchmark compares typed, active-state metadata filtering (querying by record scope and active status before fetching a body) against unstructured full-text keyword search over record bodies without type or status filters; it is not an embedding-similarity benchmark.* - -### Typed public records vs the open web - -Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). -Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). -Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). -Reading typed Proofable records capped worst-case tokens at 16,301 against 50,554 on the open web and halved cost per correct answer ($0.020 vs $0.039). - -Live web pages change between requests and cause unpredictable token spikes when agents re-scrape them. During our October benchmark runs, two fetches of the same URL 221 seconds apart returned 96,713 characters on the first request and 1,129 characters on the second, giving two agents different evidence with no way to prove what the page said when the decision was made. Across six code-graded public questions on standards, agent protocols and regulation, reading curated, signed Proofable records halved the cost per correct answer (**$0.020 vs $0.039** at Claude Sonnet 5.5 list price; 87,547 vs 136,088 total tokens) and capped worst-case token spend at **16,301 tokens** (40.7 s p95) where open-web search blew out to **50,554 tokens** and 104.3 s on a single regulatory question (**3.1× lower worst-case tail**, 1.3× spread vs 6.1× spread), while citing a checkable source on **6 of 6 answers** (vs 5 of 6 on the open web). - -*Measured October 14, 2026 on the live service: six public questions, one run for each option, same agent and model. Both options answered 6 of 6 correctly, so this sample measures cost ceiling, tail variance and provenance rather than accuracy.* - -## What it stops - -48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. -48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. -48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. -48 of 48 AgentGovBench agent-governance scenarios handled by Proofable, against the agent tools teams already use: on their own they handled 13, Cursor with the ACP gateway 37, and Claude Code or Codex with ACP 43. - -*[AgentGovBench](https://github.com/agentic-control-plane/agentgovbench) is the open 48-scenario agent-governance benchmark. Proofable's row is the policy code the live service runs, measured October 20, 2026; the other rows are the maintainers' published runs. [How the run works](#how-the-agentgovbench-run-works).* - -### The eight live tests - -**8 of 8 permission tests passed on the live service.** Every action outside the agent's permission was stopped before it ran, and the actions it was allowed to take ran. - -We ran each test on the live service on October 8, 2026, with a dedicated agent under its own fixed permission, again on October 24 on the revision production was serving then ([records](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/2026-10-24-served)), and again on November 1 on the revision production was serving then ([records](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/2026-11-01-suite)). Each link opens that test's signed record. - -| Test | What happened | -|---|---| -| [Permission granted](https://proofable.me/proof/0x64f293e61b826e03bd1de6564fc2db8cec0f50390bafc8bdf162ec9961262fca) | Ran and completed | -| [Action outside the permission](https://proofable.me/proof/0xffdc0455b72732a8c6a31eb4e2861943b85dbc271fe2dfa8b18d0e85d2b33726) | Stopped before it ran | -| [Needs approval, approved](https://proofable.me/proof/0xe662eaa54a5e3d7875827794d6a69b4e86973fee49cfa71e555f821d5ed28c35) | Held until approved, then ran | -| [Needs approval, nobody answers](https://proofable.me/proof/0x6c53cb0005c9dc30fde5bb1bd06860d74ae51790be3869a6605bfc9f71e01954) | Never ran; a late approval was refused | -| [Permission revoked](https://proofable.me/proof/0x8a3e5ff89c8a86423bae61db96c9732f319a6f6cdb34f4bde560c90d25366c95) | Stopped; no job created | -| [Permission expired](https://proofable.me/proof/0xf1880cba0876acc2364e31892b261a47299c0a70177b61b32d465fcd1b61447a) | Stopped; no job created | -| [Revoked permission reused](https://proofable.me/proof/0x1d987781eb519337fa9e62043831ee187340f6e589f217b16b99ed98be5acfbc) | Stopped every time | -| [Revoked mid-job](https://proofable.me/proof/0x05ef986ee3817a6fd56b327b1de3523ab7f65c11c4ff386d34c16f93d11c0045) | The running step finished; the next was stopped | - -On October 26, 2026, a reviewer in the AgenTrust integrations project [verified our published records offline](https://github.com/agentrust-io/integrations/issues/333#issuecomment-6414048198) on their own machine: every checksum matched and every signature verified. The project's maintainers then [chose our records](https://github.com/agentrust-io/integrations/issues/333#issuecomment-6436264551) as the dispatch evidence for their authority comparison. - -### What a takeover could send out - -**When an agent was taken over, a scoped permission refused 6 of 6 attempts to send private data out, before they ran; an all-purpose key let all 6 through.** The scoped agent still finished every task and never used a tool it did not need; under the all-purpose key, 14 of 36 runs did. Measured across 84 live runs, five published attack templates, two models, with a signed record for each run. [Run the test on your own agent](https://github.com/proofable/mcp/tree/main/examples/injection-test). - -## Run it yourself - -Time a reuse on your own machine, with no account and no API key: - -```sh -git clone --depth 1 https://github.com/proofable/docs -cd docs/public/evidence/checks -npm install -node reuse-check.mjs -``` - -It reads a finished job by its id and verifies the signed receipt on your machine: - -```text -Record 0xcf67dcc3cc9c203136daf9905a422601652fd76cce437e2cbf56967e3a8117e6 -Signature valid offline: yes -Read by id, no account: 197 ms median over 10 -Verify offline: 4.2 ms median over 10 -AI tokens used: 0 -``` - -Pass any public record id to time that record instead. - -Rerun the eight tests on any account you control with the kit in [Run the chain](/run-the-chain#run-it-end-to-end). To put receipts on your own agent's work, [add Proofable to your AI tool](/mcp/setup). - -### Run it on every pull request - -Add one workflow file and the same eight cases run in your CI, on your account, with every record verified offline and kept as a build artifact: - -```yaml -- uses: proofable/docs/public/evidence/aaif/authority-at-dispatch/action@ - with: - access-key: ${{ secrets.PROOFABLE_ACCESS_KEY }} - operator: ${{ github.repository_owner }} - kit-ref: -``` - -Pin both refs to the same commit so a rerun measures the same kit. The action writes a `trustharness.report/v1` report with each case's outcome, whether each record verified offline and the revision observed, and fails the job when the offline check fails. [Action and report schema](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/action). - -## How the AgentGovBench run works - -[AgentGovBench](https://github.com/agentic-control-plane/agentgovbench) is an open library of 48 agent-governance scenarios in eight areas: audit completeness, cross-tenant isolation, delegation provenance, fail-mode discipline, identity propagation, per-user policy, rate limits and scope inheritance. Each scenario is tagged with the NIST AI RMF controls it tests. Its maintainers revised the library in October 2026 so that nothing passes on a technicality. - -We ran the current library (commit `479c5f0`) against the exact policy code the live service runs, matched to it by hash, next to a gate that allows everything and no governance at all. The run called that code directly, so it measures the decision logic rather than the hosted service end to end. Last run: October 20, 2026. - -| Setup, current library | Scenarios handled | -|---|---| -| Proofable policy engine | 48 of 48 | -| ACP, the maintainers' gateway, live ([published run](https://github.com/agentic-control-plane/agentgovbench/actions/runs/37759892335)) | 46 of 48 | -| A gate that allows everything | 20 of 48 | -| No governance | 5 of 48 | - -On the earlier library (commit `e0ce93a`) the same engine also handles 48 of 48, where the maintainers measured the agent tools teams already use: - -| Setup, earlier library | Scenarios handled | -|---|---| -| Proofable policy engine | 48 of 48 | -| Anthropic Agent SDK with the ACP gateway | 46 of 48 | -| OpenAI Agents SDK with the ACP gateway | 45 of 48 | -| Claude Code or Codex CLI with ACP hooks | 43 of 48 | -| CrewAI or LangGraph with the ACP gateway | 40 of 48 | -| Cursor with ACP over MCP | 37 of 48 | -| Claude Code, Codex CLI, Cursor, the OpenAI or Anthropic agent SDK, CrewAI or LangGraph on its own | 13 of 48 | - -The agent-tool rows are the maintainers' [published results](https://github.com/agentic-control-plane/agentgovbench/tree/main/results), run end to end against their gateway on the earlier library. Same scenarios and scorer, different setups: the tables compare what each approach covers. - -**Why standalone agents handle 13, the reference gateway handles 46, and Proofable handles 48:** - -- **Standalone coding agents (13 of 48):** Claude Code, Codex CLI and Cursor only have local tool-permission prompts (`allow/deny` bash or file access). They have no owner-bound agent identity, no cross-agent delegation, no spend caps, no external policy engine, and no signed audit trail. -- **Stateless API/MCP gateway (46 of 48):** A proxy gateway in front of tool calls enforces rate limits, role-based access, tool allowlists, and server logs, which covers 46 of the 48 checks. -- **The final 2 checks a stateless gateway cannot do (48 of 48):** A proxy gateway only sees the HTTP or MCP request in flight. It cannot verify (1) an **owner-signed, revocable delegation** binding the human principal to that specific agent identity, task scope, spend cap and expiry (such as holding a sub-agent to a narrower scope than its parent), or (2) a **signed execution receipt** (`qHash`) binding the input, policy state and output so a downstream agent or external reviewer can verify what ran offline without trusting the gateway's database. - -**See what your agent does with and without Proofable.** Paste your agent's repository and one run reports your score on the same 48 scenarios beside Proofable's, a scan of the repository and its MCP surface, and a probe of your MCP endpoint when the repository names one: [run the audit on your own agent](https://proofable.me/verify?gateId=gate_25cfeb508d484170a2ce). Every script behind the run is public in [`public/evidence/benchmarks`](https://github.com/proofable/docs/tree/main/public/evidence/benchmarks), pinned by commit and checksum. - -## Unit economics of portable verification reuse - -Unlike the live LLM and governance runs above, portable identity reuse is a **pricing model** calculated from published vendor list prices (`stripe.com/pricing`, `sumsub.com/pricing`, `veriff.com/pricing`, `onefootprint.com/pricing`) and Proofable's $0.0025 per-check list rate. When a person or organization completes an interactive check once and wraps the result in a portable proof, downstream apps and agents verify the existing proof instead of paying the vendor to re-run the flow: - -| Vendor check | 100 relying parties, re-verified each time | 100 relying parties, verify once + reuse | Published source | -|---|---|---|---| -| Stripe Identity ($1.50 pay-as-you-go) | **$150.00** (100 flows) | **$1.75** (1 flow + 100 checks, 85× lower) | stripe.com/pricing | -| Sumsub Basic ($1.35 per check) | **$135.00** (100 flows) | **$1.60** (1 flow + 100 checks, 84× lower) | sumsub.com/pricing | -| Veriff Essential ($0.80 per check) | **$80.00** (100 flows) | **$1.05** (1 flow + 100 checks, 76× lower) | veriff.com/pricing | -| Footprint KYC ($0.50 per check) | **$50.00** (100 flows) | **$0.75** (1 flow + 100 checks, 67× lower) | onefootprint.com/pricing | - -## Details for reviewers - - - - The eight tests produced 15 signed records. Check all of them on your machine, with no account: - - ```sh - git clone --depth 1 https://github.com/proofable/docs - cd docs/public/evidence/aaif/authority-at-dispatch/2026-10-08-eight-case - sha256sum -c SHA256SUMS - npm install @proofable/sdk@0.1.10 - node verify-portable-proofs.mjs - ``` - - - - **150 of 150 forged records caught.** We changed each of our 15 real records ten ways, such as editing the content, swapping the owner or flipping one bit of the signature. Every changed copy failed offline signature verification and every real record passed. A check that only looks at the format accepted all 150. - - ```sh - git clone --depth 1 https://github.com/proofable/docs - cd docs/public/evidence/checks - npm install - node tamper-check.mjs - ``` - - - - Each result maps to the published control it gives evidence for. None of these mappings is a certification or a compliance opinion. - - | Result | Maps to | Details | - |---|---|---| - | An action outside the permission, or under a revoked, expired or reused revoked permission, was stopped before it ran; the granted action ran. 5 of 5 | OWASP Top 10 for Agentic Applications 2026: ASI03 Identity and Privilege Abuse, ASI02 Tool Misuse | The eight live tests | - | An action that needs approval was held until approved; with no answer it never ran, and a late approval was refused. 2 of 2 | EU AI Act Article 14, human oversight | The eight live tests | - | A permission revoked mid-job: the running step finished and the next step was stopped. 1 of 1 | OWASP ASI10 Rogue Agents | The eight live tests | - | 15 of 15 signed decision records verify offline, with no account | EU AI Act Article 12, record-keeping; NIST NCCoE Software and AI Agent Identity and Authorization project, auditing (concept paper, February 2026) | Verify every record offline | - | 150 of 150 changed copies rejected across ten kinds of forgery; 15 of 15 real records accepted; a check that only reads the format accepts all 150 | OWASP ASI07 Insecure Inter-Agent Communication | Try to fake a record | - | A finished result verified offline in 3.7 ms with zero AI tokens and no account; producing it took 2.79 s and 2,426 tokens | CAIP-380 Portable Proof | What one check costs you | - | AgentGovBench, current library: 48 of 48, against 46 for the maintainers' gateway, 20 for a gate that allows everything and 5 with no governance | NIST AI RMF GOVERN-1.1, 1.2, 1.4; MAP-2.1, 4.1; MEASURE-2.3, 2.6, 2.7; MANAGE-2.1, 2.2, 4.1 (the controls tagged on the scenarios) | How the AgentGovBench run works | - - The frameworks: [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), the [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), the [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework), the [NIST NCCoE agent identity and authorization project](https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization) and [CAIP-380](https://github.com/ChainAgnostic/CAIPs/blob/main/CAIPs/caip-380.md). - - diff --git a/index.mdx b/index.mdx index a6934a9..cdedfb5 100644 --- a/index.mdx +++ b/index.mdx @@ -38,7 +38,7 @@ Adds Proofable to the AI tools on your machine. Your client opens the sign-in th Person, agent, permission, decision and receipt, each checked offline. - + What it stops and saves, measured on the live service. diff --git a/learn/compare/proofable-or-a-policy-engine.mdx b/learn/compare/proofable-or-a-policy-engine.mdx index 01033fc..f09816e 100644 --- a/learn/compare/proofable-or-a-policy-engine.mdx +++ b/learn/compare/proofable-or-a-policy-engine.mdx @@ -42,7 +42,7 @@ Your engine can still run before or after this check. [Standards and interoperab Keep a record of each decision. - + Every benchmark, with its scope and how to rerun it. diff --git a/learn/compare/proofable-or-an-identity-provider.mdx b/learn/compare/proofable-or-an-identity-provider.mdx index eb6a008..a191fe6 100644 --- a/learn/compare/proofable-or-an-identity-provider.mdx +++ b/learn/compare/proofable-or-an-identity-provider.mdx @@ -47,7 +47,7 @@ Keep the provider for sign-in and add Proofable for the authority decision in th Give each agent an owner you can check. - + How Proofable compares against standalone coding agents, gateways, and unstructured memory. diff --git a/run-the-chain.mdx b/run-the-chain.mdx index e9f9d1e..3d3e4b1 100644 --- a/run-the-chain.mdx +++ b/run-the-chain.mdx @@ -92,8 +92,8 @@ network call and no account. The [CAIP-380 profile](/learn/standards/caip-380) d form, so you can write the same check in another language, and the [signing format](/verification/signing-format) covers wallets that sign with something other than an EOA. -Published runs, with the records and a script that verifies every envelope in them: -[authority-at-dispatch evidence](/evidence). +Published runs, with the records and a script that verifies every envelope in them, are on the +[Benchmark](/benchmark) page. ## What the chain does not cover