The Policy Check Needs a Receipt

An audit trail can show what an AI agent did. It does not necessarily prove that the required guardrail ran before the action was allowed.

NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs tests a stricter pattern. It commits permitted tools and constraints before execution, intercepts each proposed tool call, and releases the call only after a proof of the guardrail computation has been verified.

The paper was submitted to arXiv on August 7 at 12:36:52 UTC and appeared in the August 10 cs.AI batch. It is included through Keelbase Signal's August 11 catch-up review; the batch appearance is the discovery route, not a new publication event.

A declared policy is not evidence that it ran

At session start, NiyamAI serializes the agent's allowed tools and constraints into an Intent Contract and commits that contract using SHA-256. Proposed tool calls do not go directly to execution. A separate Judge model first evaluates the action against the contract.

If the Judge approves the call, the system uses EZKL to generate a zk-SNARK for the committed guardrail computation. Execution remains blocked until the proof verifies. The resulting receipt can be checked without exposing the Judge model's weights.

That changes the evidence boundary. A policy document or system prompt describes the intended control. An internal log says the system claims to have applied it. A verifiable proof can establish that a particular committed computation produced the represented decision before the tool call was released.

Consequential execution may need portable proof that the required control was applied—not merely a record produced by the system being checked.

Source: NiyamAI (opens in a new tab), submitted August 7, 2026.

The receipt proves less than the policy means

The cryptographic result is precise, but narrow. It does not prove that the Intent Contract expressed the founder's real intent, that its policy was well designed, or that the Judge classified the proposed action correctly. It also does not prove that every execution route in a larger system was forced through the verifier.

The receipt establishes that the committed computation ran and produced the represented output. Semantic correctness remains outside that proof. So do system-boundary questions such as key management, contract construction, model integrity and whether an attacker can reach an unguarded execution path.

This distinction prevents “provable guardrails” from expanding into a general safety claim. The useful architecture is a separation of duties: declared authority, an isolated decision step, proof of that step, verification, and only then execution.

The reported benchmark needs a fair-comparison warning

NiyamAI is evaluated on 2,000 scenarios from Agent-SafetyBench. The paper reports an F1 score of 88.5% and a 1.1% false-positive rate. Paired tests report statistically significant improvements over NeMo Guardrails, Llama Prompt Guard 2 and GPT-OSS-Safeguard.

Those results should not be described as general superiority. NiyamAI's Judge was adapted to Agent-SafetyBench, while the comparison systems were evaluated zero-shot. The paper acknowledges the difference, but it gives NiyamAI a methodological advantage in the reported comparison.

The proof layer also adds latency. The authors report approximately 2.26 seconds to generate a proof for each approved action and approximately 53 milliseconds to verify it. That may be acceptable for high-consequence actions and excessive for routine calls. A practical system would likely need risk-tiered enforcement rather than imposing the same proof burden everywhere.

From a chain of evidence to an execution receipt

Keelbase Signal's August 3 brief, Authority Is a Chain of Evidence, argued that governance depends on preserving the links between declared authority, delegation, execution and outcome. NiyamAI extends that thesis at one specific link: the transition from a proposed action to permitted execution.

The new question is not only whether the action can later be traced back to a policy. It is whether the enforcement step can produce independent evidence at the moment the action crosses the boundary.

That does not replace conventional authorization, logs or post-execution review. It makes one enforcement claim more independently testable. For governed autonomous systems, that can be valuable wherever the cost of an unverifiable policy bypass is higher than the latency and operational burden of producing the receipt.

Sources and limitations

NiyamAI is an author-reported preprint and prototype evaluation, not an independent production assessment. The paper does not establish production safety, complete mediation across every execution route, or correctness of the policy and Judge semantics.

• NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs (opens in a new tab)
• Supporting research considered in the catch-up review: TEPA (opens in a new tab), An End-to-End Agent Auditing Engine (opens in a new tab), EMAS (opens in a new tab), and SkillProx (opens in a new tab)