00 The verification layer for AI agents

Verify the reasoning before the action.

FineSchema is a deterministic verification gate for agentic AI. When an agent proposes an action, FineSchema checks whether the reasoning is sound — before anything is written back to your systems of record.

~0.2mslocal verification
100%replay match in local benchmark
CPU-onlyNo model weights
verify-before-action
PROPOSALfreeze_account · A-501
RATIONALE"every account with a
chargeback is fraud — freeze it"
└─ FineSchema gate · deterministic
VERDICTBLOCKED
REASONovergeneralization
TRACEtrace:9dfbb5… · replayable
Why we're not another platform
Data & ontology platforms

help an agent see more — connect the data, map the ontology, widen what it can reach.

FineSchema

decides whether the agent should act — a deterministic verdict on the reasoning, in the instant before the write-back.

We don't ingest your data or run your operations. We sit at the one moment that matters — the action — and return VERIFIED · UNCERTAIN · BLOCKED, with a trace you can replay.

Live demo · runs in your browser

Try the gate. Edit the reasoning, watch the verdict change.

Give an agent an action and a rationale. FineSchema returns a deterministic verdict — VERIFIED, UNCERTAIN, or BLOCKED — before the action could ever execute. A prototype deterministic gate runs in your browser. It demonstrates the inspection pattern, not the full production engine.

Industry
Agent action
Agent rationale (natural language) Known conditions from your data (toggle)
Examples:
Naive Guardrail vs FineSchema
INPUT"Freeze every account with a chargeback."
Naive keyword guardrail
PASS

No blocked keyword in the string. "chargeback" and "freeze" are both allow-listed terms, so it lets the action through.

LLM judge
Likely acceptable

Plausible-sounding and on-topic, so the model rates it fine — non-deterministically, and with no reproducible reason it can defend to an auditor.

FineSchema
BLOCKED

Reason: overgeneralization. Trace: chargeback is a risk signal, not sufficient evidence of fraud. A blanket "every" cannot be justified from a single condition.

Python SDK · runs locally, deterministic
pip install fineschema

import fineschema
v = fineschema.verify(
    "freeze_account",
    "freeze every account with a chargeback")
v.verdict       # BLOCKED
v.block_reason  # OVERGENERALIZATION
Hosted API · one call
curl -X POST https://fineschema-api.vercel.app\
/api/verify-action -d '{
  "action_type": "approve_loan",
  "rationale": "approve it",
  "context": {"situation_tags":
    ["NO_INCOME_VERIFICATION"]}}'
# {"verdict":"BLOCKED",
#  "block_reason":"POLICY_VIOLATION"}
01 The gap

AI agents now take actions. Nothing verifies their reasoning.

Modern AI platforms govern who can act, on what data, with which permissions — and they log data lineage. But the reasoning itself — the inference from data to recommendation — stays probabilistic, non-reproducible, and unchecked at runtime.

01.1

Permissions are not verification

Access controls and approval rules decide authority over data. They never ask whether the model's inference is coherent, grounded, or free of overgeneralization.

01.2

Audit is data lineage, not reasoning

You can trace where a number came from. You cannot reproduce why the agent recommended an irreversible action — the rationale is a black-box, run-to-run variable.

01.3

Systems fail open

Language models are built to be helpful. Under ambiguity they still produce a confident output — and an agent will act on it.

01.4

The stakes are now actions

When an agent freezes an account, deletes a record, or administers a dose, "review it later" is not a control. The check has to happen before the write-back.

02 The engine

A reasoning kernel — not another model.

FineSchema does not generate answers. It verifies whether a judgment is formally legitimate, checking it against a deterministic schema of valid inference built on Kant's twelve categories. CPU-only. No model weights. Same input, same output, every time. When reasoning is incoherent, overgeneralized, or ungrounded, it fails closed.

Verified

Execute

The reasoning is sound and within policy. The action proceeds.

Uncertain

Route to a human

Borderline or unsupported. The action is staged for a mandatory human checkpoint.

Blocked

Reject with a reason

A formal defect or policy violation. The write-back is refused and the reason is recorded.

02.5 Kant → Gate Mapping

How Kant's categories become runtime gates.

The twelve categories aren't a metaphor. Each one compiles into a concrete, deterministic gate on the agent's rationale. Four of the load-bearing ones, each with a real example failure:

Quantity→ Overgeneralization Gate
EXAMPLE"every account with a chargeback" → BLOCKED
BLOCKEDOVERGENERALIZATION — a universal ("every") asserted from one condition. A blanket rule can't follow from a single signal.
Relation→ Causal Validity Gate
EXAMPLE"chargeback therefore fraud" → causal gap
BLOCKEDNO_CAUSAL_LINK — a correlation is treated as the cause. The inference has a causal gap and doesn't connect.
Modality→ Certainty / Uncertainty Gate
EXAMPLE"possible risk" ≠ "verified fraud"
UNCERTAINUNGROUNDED_CERTAINTY — a possibility is acted on as a settled fact. Routed to a human checkpoint, not auto-executed.
Quality→ Positive / Negative Condition Gate
EXAMPLEmissing income verification → policy violation
BLOCKEDPOLICY_VIOLATION — a required positive condition is absent. Fail-closed: missing evidence is not a green light.

The remaining categories (totality, plurality, substance, community, possibility, existence, necessity, limitation) compile into the same kind of fixed checks — together they form the schema of valid inference the gate runs, identically, every time.

03 How it works

A reasoning firewall between the agent and the write-back.

FineSchema sits in the action path. The agent proposes; FineSchema returns a deterministic verdict and a replayable audit trace; only verified actions execute.

AI agent proposes action FineSchema gate deterministic · ~0.2ms kant gates + policy VERIFIED → action executes UNCERTAIN → human checkpoint BLOCKED → rejected + reason Inference lineage · replayable
04 Measured

Built to run everywhere, certify cleanly, and never drift.

Local deterministic verification, measured on a developer machine. Every number below comes from one reproducible script — the method is published in full, so you can re-run it yourself.

0.191msmean / action · p95 0.214ms
~5,241/sverify · single core
1000/1000replay · deterministic
air-gappedCPU-only · No model weights
Benchmark Method · reproducible .venv/bin/python scripts/audit_and_latency_demo.py · view raw result JSON ↗
HardwareApple M4 Pro · 14 cores · 48 GB · macOS
RuntimePython 3.9.6 · CPU-only · no GPU · No model weights
Build stampengine 480cf18e · measured 2026-06-12
Result filebenchmark/results/latest.json · same values shown here
Test cases1,000 timed calls + 20 warm-up · 175 policy rules loaded (100% pass)
Action familiesfinancial (55) · healthcare (40) · insurance (40) · HR (40)
Latency methodtime.perf_counter() around verify_action(); samples sorted; p50/p95/p99 from order statistics
Throughput method1000 ÷ mean latency · single core · no batching
Reproducibilityreplay(trace_id) returns identical verdict + identical meaning assignments · replay 1000/1000 match
mean 0.191ms · p50 0.186ms · p95 0.214ms · p99 0.281ms
~5,241 verify/s · single core · no batching
replay 1000/1000 deterministic — trace_id → identical verdict + meanings ✅
Raw results (JSON) →

Local prototype benchmark on Apple M4 Pro. Results vary by hardware, cartridge complexity, and action family. These are single-machine figures for the deterministic gate itself, not an end-to-end SLA. A reproducible public case-set with broader hardware coverage is in progress.

Non-deterministic models cannot be formally verified or certified. A deterministic gate can be specified, tested, and accredited — the same component, byte-for-byte, in the cloud or inside a classified enclave.

The platform

Four parts. One verdict you can trust.

Not a model and not a data platform — a small, inspectable kernel and the pieces around it. Every part is built to be specified, tested, and certified.

FineSchema verifies the reasoning behind every autonomous decision — in finance, healthcare, insurance, and HR — before the action is ever taken.

05 Industries · Action Family Library

Exactly what we stop, in each domain we serve.

One engine, a cartridge per industry. Below: the action an agent proposes, the verdict FineSchema returns before it commits, and the Action Family Library — the concrete actions we gate in each domain.

verify-action · financial
ACTIONapprove_loan · L-4471
RATIONALE"approve — applicant has no income verification"
└─ deterministic gate · 0.18 ms
BLOCKEDPOLICY_VIOLATION
RULENO_INCOME_VERIFICATION → toxic
TRACEtrace:9a3f2c… · replayable
Financial services

Don't let an irreversible action run on flawed inference.

Account freezes, loan decisions, wires, refunds. A wrongly frozen account or a non-compliant loan is immediate, measurable damage — and a regulator's question.

Action familyfreeze_accountapprove_loanreject_wireclose_account
"approve the loan — no income verification" BLOCKED · POLICY
verify-action · healthcare
ACTIONadminister_medication · M-2208
RATIONALE"give the prescribed dose to the patient"
└─ deterministic gate · 0.17 ms
BLOCKEDPOLICY_VIOLATION
RULECONTRAINDICATION → toxic
TRACEtrace:c71e80… · replayable
Healthcare

Catch the unsafe order before it reaches the patient.

Medication orders, discharges, dosing. Block a contraindicated dose or an unstable-vitals discharge before it executes; route the borderline to a clinician — with a record of why.

Action familyadminister_medicationdischarge_patientescalate_careschedule_followup
⚠ Illustrative only — requires regulated validation before clinical deployment.
"administer the medication — contraindication on file" BLOCKED · POLICY
verify-action · insurance
ACTIONdeny_claim · C-7731
RATIONALE"deny every claim from this postal code"
└─ deterministic gate · 0.18 ms
BLOCKEDOVERGENERALIZATION
REASON"every" — a blanket denial isn't justified
TRACEtrace:4db6f0… · replayable
Insurance

Stop the discriminatory or overgeneralized decision.

Claims, underwriting, premiums. "Deny every claim from this postal code" is both overgeneralized and a fair-practice risk — blocked deterministically, with the reason on record.

Action familydeny_claimapprove_payoutadjust_premiumflag_fraud
"deny every claim from this postal code" BLOCKED · OVERGEN.
verify-action · hr
ACTIONreject_candidate · K-913
RATIONALE"reject all candidates over fifty"
└─ deterministic gate · 0.18 ms
BLOCKEDOVERGENERALIZATION
REASON"all over fifty" — age-proxy + blanket rule
TRACEtrace:50bfb3… · replayable
HR & people ops

Block the protected-class proxy before an agent acts on it.

Screening, terminations, accommodation. "Reject all candidates over fifty" or a retaliatory termination is caught and blocked — protecting candidates and the company alike.

Action familyreject_candidaterank_candidateterminate_employeedeny_accommodation
"reject all candidates over fifty" BLOCKED · OVERGEN.

Also live: government & defense (air-gapped, certifiable), trust & safety, data governance. Any domain where a wrong autonomous action is irreversible.

05.5 Case Examples

Five real cases, end to end.

For each: the proposed action, the AI rationale, what a naive guardrail misses, the FineSchema verdict, the trace, the missing evidence, the safer action — and why it matters.

Financefreeze_account
Proposed actionfreeze_account · A-501
AI rationale"Freeze every account with a chargeback."
Naive guardrail missesNo banned keyword — "freeze" and "chargeback" pass a keyword filter; an LLM judge rates it plausible.
FineSchema verdictBLOCKED overgeneralization
TraceQUANTITY_GATE_FAILED → EVIDENCE_INSUFFICIENT → VERDICT_BLOCKED
Missing evidenceNo fraud investigation; a chargeback is a risk signal, not confirmed fraud.
Safer actionFreeze only A-501 after a confirmed-fraud investigation; route the rest to review.
Why it mattersA blanket freeze locks out legitimate customers and invites a regulator's question.
Insurancedeny_claim
Proposed actiondeny_claim · C-7731
AI rationale"Deny every claim from this postal code."
Naive guardrail missesReads as a normal claim decision; nothing in the string is obviously disallowed.
FineSchema verdictBLOCKED overgeneralization + fair-practice risk
TraceQUANTITY_GATE_FAILED → RELATION_GATE_FAILED → VERDICT_BLOCKED
Missing evidenceLocation correlates with risk but doesn't cause this claim's invalidity; no per-claim basis.
Safer actionAdjudicate C-7731 on its own merits against the policy exclusion; no blanket geo rule.
Why it mattersGeographic blanket denials are a textbook fair-practice and disparate-impact exposure.
HRreject_candidate
Proposed actionreject_candidate · K-913
AI rationale"Reject all candidates over fifty."
Naive guardrail missesA toxicity/keyword filter sees no slur; the intent is a protected-class proxy.
FineSchema verdictBLOCKED age-proxy + blanket rule
TraceQUANTITY_GATE_FAILED → QUALITY_GATE_FAILED → VERDICT_BLOCKED
Missing evidenceNo bona-fide job requirement tied to the decision; age stands in for merit.
Safer actionScore K-913 against documented bona-fide requirements only; no protected-class proxy.
Why it mattersAutomated age screening is direct discrimination liability at scale.
Healthcareescalate_care
Proposed actionescalate_care · P-2208
AI rationale"Don't escalate — nothing on file says the patient is unstable."
Naive guardrail missesNo unsafe wording; the silent failure is treating missing data as reassurance.
FineSchema verdictUNCERTAIN absence ≠ evidence of stability
TraceQUALITY_GATE_FAILED → EVIDENCE_INSUFFICIENT → ROUTE_TO_CLINICIAN
Missing evidenceNo recent vitals confirming stability; absence of a record is not a negative finding.
Safer actionRoute P-2208 to a clinician checkpoint. Requires regulated validation before clinical deployment.
Why it matters"No data" silently read as "fine" is how automated triage misses a deteriorating patient.
Refundswithhold_refund
Proposed actionwithhold_refund · R-3360
AI rationale"Withhold the refund — this customer always disputes charges."
Naive guardrail missesSounds like ordinary fraud caution; "always" hides an unfounded universal.
FineSchema verdictBLOCKED overgeneralization
TraceQUANTITY_GATE_FAILED → EVIDENCE_INSUFFICIENT → VERDICT_BLOCKED
Missing evidenceNo record this specific refund is invalid; "always disputes" isn't documented or relevant.
Safer actionAssess R-3360 against the refund policy on its own facts; escalate only on documented abuse.
Why it mattersReputation-based withholding breaches consumer-protection rules and erodes trust.
06 Integration

Drops into your agent stack as a reasoning firewall.

FineSchema runs between your agent — Palantir AIP, a custom orchestrator, or any agentic platform — and your systems of record. Compile your action policy from your ontology; the engine verifies every proposal before it commits.

06.1

Sidecar

A stateless HTTP service. One call — /verify-action — returns the verdict and an audit trace.

06.2

In-platform function

Packaged as a function inside your platform, invoked in the action submission path.

06.3

Air-gapped binary

CPU-only, no network, no model weights — for classified and offline environments.

Connects to
Palantir AIPVerify-before-action gate in the Action submission path, beside Foundry Functions.
LangGraphA gate node before the tool/effect node — only verified actions proceed down the graph.
Custom orchestratorAny agent loop: call the gate before the write-back, branch on the verdict.
REST APILanguage-agnostic POST /verify-action → verdict + trace. SDK optional.
Pre-action middlewareA drop-in pre-action middleware interceptor that wraps every effectful tool call as a fail-closed checkpoint.
06.7 Security & Trust

Inspectable, replayable, deployable with minimal data exposure.

FineSchema is designed as a deterministic pre-action verification layer. It should be inspectable, replayable, and deployable with minimal data exposure. A full overview lives on the security page.

No data retention by defaultself-hosted · customer-controlled
CPU-only verificationno GPU dependency
Air-gapped deployment optionoffline · classified enclave
Audit-ready tracesreplayable · exportable

For hosted pilots, retention and logging are configured per customer agreement. Self-hosted and air-gapped deployments can be configured for customer-controlled data retention.

Data Handling

What FineSchema receives
  • Proposed action
  • Agent rationale
  • Policy cartridge
  • Relevant evidence fields
  • Optional metadata
What FineSchema stores
  • Configurable trace logs
  • Verification outcome
  • Timestamp
  • Policy cartridge version
  • No raw customer data by default in self-hosted mode
What FineSchema returns
  • VERIFIED / UNCERTAIN / BLOCKED
  • Reason code
  • Trace
  • Missing evidence
  • Safer action recommendation
What customers control
  • Policy cartridge
  • Retention policy
  • Deployment mode
  • Approval workflow
  • Audit export

Deployment Modes

The browser prototype demonstrates the inspection pattern. It is not the full production engine.

ModeUse caseData exposureOperational maturityBest for
Browser prototypeIllustrative inspection patternNone — runs client-sideDemo onlyFirst look, education
Hosted pilotScoped 14-day evaluationPer customer agreementPilotFast proof on one action family
VPC deploymentRun inside your cloud accountStays in your VPCProduction-leaningTeams with cloud governance
Self-hostedYour infra, your control planeCustomer-controlledProductionStrict data-residency needs
Air-gappedOffline / classified enclaveNo network egressProduction · accreditedDefense, regulated, classified

Sub-processors

Sub-processors are determined by deployment mode. Self-hosted and air-gapped deployments can minimize or eliminate third-party processing. Hosted pilots may use infrastructure providers such as Vercel or email delivery providers if configured.

Deployment modePossible infrastructureCustomer data exposureNotes
Self-hosted / Air-gappedNone requiredCustomer-controlledCan eliminate third-party processing
VPCYour own cloud accountStays in your VPCNo FineSchema-side processing of raw data
Hosted pilote.g. Vercel / email delivery, if configuredPer customer agreementNot a confirmed sub-processor list until contracted

Compliance posture

FineSchema is not currently claiming SOC 2, HIPAA, ISO, or GDPR certification. Compliance posture depends on deployment mode, customer requirements, and validation scope.

  • SOC 2-ready roadmap
  • HIPAA-regulated deployments require customer-specific validation
  • GDPR and regional privacy review required before production deployment
06.5 14-day pilot

From one action family to a fail-closed checkpoint, in two weeks.

A pilot is scoped to a single action family in your environment — your policy, your data, your verdict log. No rip-and-replace, no model retraining.

Day 1–2:
choose one action family
Pick the highest-stakes action your agents already take — e.g. freeze_account. Scope is one family, not your whole stack.
Day 3–5:
encode policy cartridge
Your rules for that family, compiled once from your ontology into a deterministic cartridge.
Day 6–8:
run shadow verification
FineSchema verifies live proposals alongside production — observing, never blocking yet. Every verdict logged with a replayable trace.
Day 9–11:
compare against human review
Put the gate's verdicts next to your reviewers'. Measure agreement, catches, and false positives on real traffic.
Day 12–14:
deploy fail-closed checkpoint
Flip the gate inline on the action path. Verified executes, uncertain routes to a human, blocked is refused with a reason.

What to bring to a pilot

Customer should provide
  • One action family
  • Policy documents
  • Sample agent rationales
  • Human review examples
  • Approval / rejection criteria
  • Deployment environment constraints
What FineSchema provides
  • Policy cartridge draft
  • Shadow verification setup
  • Trace review
  • Failure taxonomy
  • Deployment recommendation
Pilot deliverables
  • Verdict log over real traffic (VERIFIED / UNCERTAIN / BLOCKED)
  • Agreement + catch report vs. human review
  • A fail-closed checkpoint wired into the action path
  • Reproducible benchmark on your cartridge
Success criteria
  • Catches the unsafe actions your reviewers would
  • False-positive rate inside your agreed bound
  • Every verdict replays byte-identical
  • Gate added < 1 ms to the action path
07 Access

Start with a pilot, not a price sheet.

Metered API pricing arrives when the paid, public API does. Today every engagement starts as a scoped pilot on one action family — so we can prove the catch rate on your traffic before anyone talks dollars per call.

Developer Preview
Free
evaluate the pattern locally
  • pip install fineschema · local deterministic gate
  • Prebuilt cartridges (financial, clinical, …)
  • Replayable audit traces
  • Community support
Start free
Start here
Pilot
14 days
scoped · one action family
  • Your policy cartridge, your data
  • Shadow verification → fail-closed checkpoint
  • LangChain / LangGraph / AIP adapters
  • Hands-on support from our team
Request a pilot
Enterprise / Air-gapped
Custom
on-prem · classified
  • Air-gapped CPU binary — no weights, no network
  • Cartridge authoring with your domain experts
  • SSO, audit export, dedicated support
  • Certification support (FedRAMP / IL5–6 / EU AI Act)
Talk to us
What's at risk without a gate

Estimate only — it sizes the exposure a verification gate sits in front of, not a quote. Actual catch rate depends on your policy cartridge coverage, validated in the pilot.

08 Request Access

Don't let AI act on reasoning no one checked.

Tell us your stack and the first action you need to govern. We'll scope a pilot on one action family in your environment — your policy, your data, your verdict log.

Air-gapped required?
Try the live demo

09 FAQ & Trust

Straight answers, honest limits.

Is FineSchema a replacement for human review?
No. FineSchema makes AI action reasoning inspectable before execution. Human review remains necessary for high-stakes deployments.
Is the browser demo the full production engine?
No. It is a prototype deterministic gate that demonstrates the inspection pattern, not the full production engine.
Does FineSchema use LLM weights?
The verification gate is designed to run CPU-only without model weights. Integrations may still sit beside LLM-based agents.
What is a policy cartridge?
A domain-specific rule and evidence package that defines what an AI action must satisfy before execution.
Can FineSchema run air-gapped?
The architecture is designed for self-hosted and air-gapped deployment, subject to customer validation.
Does FineSchema store customer data?
Data retention is configurable by deployment mode. Self-hosted and air-gapped deployments can be configured for customer-controlled retention.
Can FineSchema run without sending data to an LLM?
The verification gate is designed to run without model weights. It can sit beside LLM agents without sending verification logic to an LLM.
Is FineSchema certified for regulated industries?
No certification is currently claimed. Regulated deployments require customer-specific validation and review.
Can customers export audit traces?
FineSchema is designed to produce replayable traces and audit-ready records for review.

FineSchema is not a universal safety guarantee. It is a deterministic verification layer for inspecting action reasoning before execution.

Browser demos are illustrative prototypes. Production deployments require domain validation, policy cartridges, and customer-specific review.

Healthcare and other regulated domains require regulated validation before clinical or operational deployment.

The broader vision

Verification is step one. Judgment is the mission.

Agent Verification is the enterprise product. The Cognitive Truth Engine is the broader epistemic research vision — evaluating truth, emotion, and judgment by evidence, context, and contradiction.