Live session
A support agent reads a poisoned ticket.
Five steps, four of them permitted. Identity never drops, the action never leaves scope, and the trust score stays high throughout — which is exactly why none of those catch the last one.
The transcript is recorded from the engine. The digests are computed in your browser as you read, and the verification either holds or it does not.
support_bot
Answer customer support tickets
Ordinary work. Nothing has been read yet, so the session carries nothing and everything it touches is its own.
operation
search /tickets/open
{
"status": "open",
"limit": 25
}information flow
integrity TRUSTED
Access granted: agent identity, purpose, and behavior all check out (score 92.4/100).
action_ref
computing…
Signed by key ebdf1d012508e7ae. An auditor runs the same check offline with the published key and no access to anything else.
Step 05 is the one that matters. Nothing about the agent changed — same identity, same permissions, same purpose, same high score. The ticket changed where the data was going, and a session carrying content the agent did not author does not get to make that choice.