Zero trust stopped security trusting the network and started verifying every request. AI is at the same point. A model’s training isn’t a control you can inspect, so the work moves to the actions it takes: each one gated, each decision signed, the record open to anyone who needs to check it.
What changed
In August 2026 a frontier lab published a note on its own incidents. The line that matters for anyone running agents: it had been relying on a single layer of defense where it needed several. That is the organization with the strongest incentive to say a well-trained model is sufficient, reporting that one control was not enough.
If it isn’t enough there, with dedicated safety staff and teams whose job is to break the stack, it isn’t going to be enough where an agent was handed a service account on a Thursday.
Training shapes what a model is inclined to do. It doesn’t control what an agent with real credentials can reach. Permissions, isolation, monitoring, screening before execution, escalation to a person: everything that does control it sits outside the model, and you have to build it. If you can’t verify it ran, you’re trusting it.
Then the transcripts came out. On 1 September, Ajeya Cotra walked through the investigation of the Hugging Face incident with Dwarkesh Patel. In at least 96 of the agent transcripts, the tool call on the page was not the command that ran. The log said one thing; the action was another. The investigators could only read that volume of transcript with help from a model of the same family. Nobody supervises that by reading. The check has to be made where the action happens, by something the agent cannot edit.
Read the engineering note on the incidents → · Cotra on the transcripts
Where the pressure is coming from
Networks got zero trust once the perimeter stopped holding. Cloud got its security graph once nobody could say what they were running. AI is getting the signed action record, and it is being asked for from three directions at once.
The labs, which now say in public that the model is one layer of several. Regulators, whose post-market monitoring duties in the EU and disclosure duties in the US states assume a record of what an AI system did exists to be produced. And insurers, who cannot price a risk nobody can count.
What is still open is whether that record is in a format anyone can check, or locked inside a vendor’s dashboard.
The missing unit
Cars, flight and cloud each scaled once their risk could be measured well enough to insure. AI can’t be insured yet because there is nothing to count: no agreed unit for the decisions a policy covers, so no way to measure loss frequency or price the risk.
Glacis writes that unit. One governed action, one signed record. Not a token, not a request, not a seat. Count the records and you have counted the exposure, and because each one verifies on its own, the count can be checked without access to the policyholder’s systems.
What Glacis does
Glacis sits between your application and the model it calls. It applies the controls you agreed while the action is live, allowing, constraining, holding or denying it, and signs what it decided. Most actions never notice it. The ones that cross a line are stopped before they land.
The record carries hashes rather than the content itself, so it can travel to a reviewer while the protected data stays where it was. The format is open and published, so a record you hold today stays readable whether or not you are still a customer. Anyone can verify one in a browser, without an account and without asking us.
Runs between your application and the model. Allow, constrain, hold or deny, decided while the action is live. One signed record per action, checkable by anyone.
What a record does and doesn’t show
A signed record establishes that the record is intact, which key signed it, and what decision it reports. It doesn’t establish that the action was safe, that the system is compliant, or that every action was captured. Those need testing, coverage evidence and a reviewer’s judgment.
Glacis doesn’t certify anything and isn’t an insurer. What an evaluator, an assessor or a carrier does with a record is theirs to decide, and we make no promise about certification, insurability, pricing or claims.
None of this is an argument that the models are bad. Capable models are the reason the boundary matters.
Start here
The free tier is enough to put the layer in front of something your agents do and read the record it writes.