Manifest
Your agents already send emails, close files, flag people and move numbers. Manifest is the layer underneath that keeps three things: what each agent is allowed to do, what it actually did, and why. It works over agents we build for you, and over agents you built yourself.
Three artefacts. One question each.
None of this is exotic technology, and we do not pretend it is. Logging and evaluation tools exist. What almost nobody does is produce all three, every time, in a form a non-technical person can put in front of an auditor.
The warrant — “what may it do?”
A short signed document, and the same document in machine-readable form. It lists what the agent may do, what it may never do, when it has to stop and ask, who supervises it and how to halt it. The runtime reads it: a forbidden action is refused, not merely logged.
The log — “what did it do?”
Every step written once and never rewritten: input, model and version, tool called, output, confidence, and the human who intervened. Each entry carries the hash of the one before, so a missing or edited line shows. Exportable in full; the export is yours.
The answer — “why did it do that?”
Ask in plain language. The answer names the entries that caused the action and links to them. If the log does not support an answer, it says so instead of producing a plausible story.
agent: collections.reminder autonomy: act_on_approval supervisor: "A. Berger — Credit Manager" may: - read_invoices - draft_reminder - send_after_approval may_never: - contact_a_key_account - mention_legal_action - write_to_the_accounting_ledger stop_and_ask_when: - a reply contests the invoice - confidence < 0.85 halt: ops-desk@client · documented · 24/7
> why did account 4417 stop receiving reminders? Because a rule fired, not because someone paused it. led_47882 inbound reply read · invoice contested led_47884 rule R07 matched · confidence 0.94 led_47885 sequence halted · 3 queued steps cancelled led_47886 routed to "A. Berger" · acknowledged 11 min later Nothing was sent after 11:04Z. There is nothing to undo.
How a system reaches production.
Manifest is an instrumented rollout, not a big-bang install. Four phases, an artefact at the end of each, about four weeks in total — and nothing gets enforcement powers before it has run in shadow.
Map the estate
Every agent and automation actually running: what it can reach, who owns it, what evidence exists today. Expect two or three nobody remembers switching on.
Write the rules, build the bar
One workshop per agent with the person who owns the work. We write the warrant, and build an evaluation set from your own past cases — the bar the system has to clear.
Observe before enforcing
Traffic flows through Manifest in observe mode. Nothing is blocked yet; everything is logged. Every divergence between warrant and reality is reviewed with the owner before we arm anything.
Arm the warrants
Forbidden actions are now refused, not noted. The portal opens, the log is exportable, a named human is on escalations. On day 30, the conformance pack.
A conformance pack: the inventory, the signed warrants, the log export, the human interventions, the refused actions, and the incidents with what was done about them. It is the document you hand to an auditor, an insurer, a client's procurement team, or your own board — and the one you will need for the obligations landing in 2027 and 2028.
Who buys it
Two kinds of buyer, for the same reason. The team that already put agents into production and cannot answer for them. And the team that has been blocked from putting agents into production because nobody could answer that question in advance.
What Manifest is not
It is not a certification and it does not make you compliant with anything by itself. It produces the evidence a compliance decision needs. It is also not a model, not a firewall, and not a replacement for your own judgement about which work an agent should be doing at all.