Principle 01
The evidence layer for AI
What did your AI do? And can you prove it?
Enterprises hand more decisions to AI every quarter. Eventually someone asks what happened: a regulator, a client, a board, opposing counsel. Nothing in the standard AI stack was built to answer that.
-
Records
Every instrumented AI decision is sealed as it happens: what was asked, what was decided, under whose authority.
-
Enforces
Your rules run in the path of the action, not in a report afterward. A call can be flagged, held for a person, or stopped.
-
Proves
Anyone you hand a record to can check it themselves. No trust in Stones AI required.
The problem
The room goes quiet.
Somebody's agent approved something, sent something, moved something. Someone senior asks why it did that, and the room goes quiet. There is a log, not a defensible record.
Any system can show that an agent acted. Few can prove what it did, who authorized it, and that the record has not been altered since. Here is what is missing when the question is asked by someone who is not obligated to believe you:
- No identity binding to the agent and the human that acted
- No independent proof the record existed at that moment
- No tamper evidence if a row is changed later
Evidence that requires trusting the party who produced it is not evidence. It is a claim.
Why nothing answers it
Four good tools. None of them evidence.
Each of these was built to help your team operate. None was built to let an outside party check.
- Observability
- Mature, and genuinely good at what it does. It is also operator controlled and editable, which means the party being asked the question controls the answer.
- Model monitoring
- Reports averages across thousands of calls. An audit is about one call, on one account, on one day.
- Guardrails
- Blocks bad output at runtime, and the category is improving fast. It still leaves no artifact anyone outside the company can check.
- GRC platforms
- Track that a policy exists. Not that a particular decision followed it.
What it costs you
Your AI does not have a capability problem.
It has a delegation ceiling. AI is allowed to do only what the business can prove about it. The limit is evidence, not capability.
Every rung up this ladder is worth more than the one below it, and every rung raises the standard of proof somebody will ask you to meet.
- 01
Read
Human drivesIt retrieves and summarizes. It changes nothing. The question is what data it touched, and whether it was allowed to.
- 02
Recommend
Human decidesIt proposes, a person disposes. Most enterprises are here, and most of them stall here.
- 03
Act
Human approvesIt changes something real. A ticket, a price, a customer message. Once AI changes state, "we think it was fine" stops being an answer.
- 04
Automate
Human auditsIt acts repeatedly without review of each action. One bad rule can execute ten thousand times before anyone notices.
- 05
Transact
Agent to agentIt commits money or obligation. Nobody reaches this rung on trust. They reach it on evidence, or they do not reach it at all.
Most enterprises stop somewhere around rung two, and the reason is almost never the model. It is that nobody wants to sign for what happens on rung three without a record.
What we build
V1 alpha · pre-production hardening
VAiDR sits where your agents act and seals every action into a signed, witnessed record, built to be handed to someone who does not trust you. Your policy runs before the model is called. Every decision it makes becomes a record that anyone you hand it to can verify on their own.
Think of international flying. The bigger routes are gated on papers, not flying skill. VAiDR is the papers for your AI. The visa is clearance to act under your policy. The stamps are the record of what it actually did.
The other half
trust.json
Live vendor trust
A signed compliance PDF is a photograph of a moment that has already passed. trust.json is a live signal: proof that a posture is current right now, that the other side can check for themselves, and that tells the truth the moment something slips.
VAiDR answers what your AI did. trust.json answers whether your company is safe to rely on today. Same argument, two surfaces: in both, the other side gets to verify instead of taking your word.
The boundary
Your data never leaves your VPC. What leaves is proof.
You see the whole record inside your own environment, the exchange included. Everyone else sees only what proves it happened. Those are two different readers, and we never blur them.
Stays with you
- Prompts and inputs
- Model outputs and completions
- Documents the agent touched
- Your private signing keys
Crosses the line
- Hashes of the request and response
- Signatures and your key fingerprint
- Token counts, model name, latency
- Identity, policy version, outcome
- Transparency log inclusion proofs
If Stones AI were breached tomorrow, none of your confidential data would be in it, because none of it was ever there.
Who reads it
Someone is going to ask.
The record is the same artifact in every one of these conversations. That is the point of it being independent.
- The enterprise
- What is my vendor’s AI doing here?
- The vendor
- Prove we followed the spec.
- The regulator
- Show me the decision and the policy.
- The underwriter
- What is this risk actually worth?
- The board
- How far can we let this run?
Design partners
Can you show what your AI did last quarter?
In a form your auditor would accept. If the answer is no, and your agents are already acting in your name, that is the conversation we want. Design partners shape what ships.