Approve a claim paymentRefused
£48,500.00
Above the delegated authority the role carries. Recorded with the failing check by name.
Watch the kernel decide.
Every action the platform governs is checked before it executes; an action that fails its checks does not execute. The console below shows what that looks like: a proposed action, the checks it faces, the verdict, and the record the verdict leaves.
Admissible kernelInsurance pack
1 An agent asks
Delete a record
Policy PL-88214
2 The kernel checks it8/9
- Value limitpassed
- Delegated remitpassed
- Retention rulefailed
- Sanctions screenpassed
- Spend quotapassed
- Who is askingpassed
- Rules versionpassed
- Record sealedpassed
- Chain intactpassed
3 The kernel answers
Refused
The action never ran.
Retention rule did not pass
rec_01J9X4F1Q5 · ed25519:7a20…8ef1Signed. Verifiable without us.Mode
Replay of curated scenarios, labelled on the console.
Determinism
Same input, same verdict, every time.
Failure mode
Cannot decide means refuse. Never wave through.
Scenarios
The five scenarios. Four refusals and an allow.
Each one is a moment where an agent proposed an action and a rule stood in the way — or nothing did, and the action went through with a record behind it.
Send a settlement letterHeld
Not on the case
The addressee is not on the case record. Nothing is sent until a person releases it.
Export a case fileRefused
No rule allows it
No rule allows it, so the kernel refuses. Absence of permission is not permission.
Adjust a reserveAllowed
In bounds
Within authority, within bounds, in the right order. Allow is a verdict too, and it is sealed like the others.
Dispatch an engineerRefused
Certification lapses
The certification expires before the job ends. Refused below the application, on every write path.
What they have in common
None of them is about what a model said. All of them are about what a system was about to do.
The kernel's question is the same each time: is this action, from this actor, within these rules, right now?
Illustrative. Synthetic scenarios in the shape the kernel records them. No personal data, not live records.
Refused
A refused action is recorded with the reason it was refused.
Held
An action held for approval resumes by replaying only what was approved — nothing else.
Allowed
Every governed action is sealed in a signed, tamper-evident record.
Refused
Where the platform gates a dispatch, the refusal is enforced at the database itself, on every write path.
Honesty
What this console is, today. The labelling changes when the wiring does, and not before.
Live
Now: a labelled replay
Until the isolated sandbox is connected, the console on this page replays the five curated scenarios. It says so on the console itself, in the note beneath the output, every time it runs.
We do not present a replay as the kernel, here or anywhere else on this site.
At launch
At launch: the live sandbox
The console then drives a real kernel instance: isolated from everything else, loaded with synthetic industry packs, rate-limited, accepting no personal data, and behind a kill switch on our side.
Determinism
Run it a thousand times. The number that matters is the last one.
Same input, same verdict, every time. That is the property that makes a verdict evidence rather than opinion. A sampled model gives you a distribution; deterministic checks give you a fact you can put in front of an auditor.
When the live sandbox connects, this console gains a replay control: one scenario, submitted a thousand times, and a running count of distinct verdicts.
Start here
Rather see it on your own workflow?
Bring one where an AI action worries you. You will watch the verdict arrive, and see the record it leaves.