Allow
It runs
The call passed every check. The decision and its reason are recorded.
Layer 06
Every call. A verdict and a reason.
A policy matters only if it is checked when the agent acts. StartiQOS checks every tool call before your agent can run it, in a fixed order, and records the result.
In one sentence: runtime verification means the decision is made at the moment of the call, against the agent’s current authority, not when access was first granted.
The Checks
Nine checks, always in this order.
Each check depends on the ones before it, so the order never changes.
01
Kill switch
If it is on, nothing runs.
02
Global deny list
Shell and code execution are refused everywhere.
03
Token
The agent’s token must be valid and unexpired.
04
Delegation chain
The chain back to the original request must be intact.
05
Attenuation
The agent may hold no more than its parent.
06
Policy
The capability must be in the approved policy. If it is not, the call is paused for a person.
07
Composition
The combined reach must stay within the limits.
08
Taint
The session’s taint must be within the capability’s bound.
09
Arguments
Arguments must match the expected shape. If they do not, the call is paused for a person.
The Verdict
Allow, escalate, or deny.
Every call ends in one of three answers, and every answer is recorded.
Escalate
A person decides
The agent is paused. The approver can allow it once, add it to the policy, or deny it.
Deny
It never runs
The call failed a check that a person should not override in the moment, such as a broken chain or a blocked combination.
Every decision is hash-chained. Each ledger entry includes the hash of the one before it, so changing any past entry breaks the chain. The chain head is signed at intervals, and the whole chain can be verified in one call.
Questions
Runtime checks, explained.
Under 0.05 ms at the 99th percentile in our tests (0.046 ms). The model call your agent makes takes far longer.
It never allows silently. In fail-closed mode it denies; in fail-open mode it pauses the call for a person.
Yes. It is the first check on every call, so switching it on stops every agent at once.
Changing any entry breaks the hash chain, which verification reports. That makes the ledger tamper-evident, not tamper-proof.
Find out what your agents
are actually allowed to do.
Early access starts with a two-week shadow-mode pilot. Nothing is blocked. You get the gap between the access each agent holds and the access it uses, and every combination that could move data out.