CAIN-42 · Coming next

CAIN Enterprise Verification

Independent checking of an enterprise's whole agent estate.

Last reviewed 2026-10-01

In development   Product lines in development · Product line

Where it fits

Part of Coming next: Product lines in development. Tested code, not yet sold or hosted. Every CAIN-42 product runs behind the same rule: an AI agent's action is checked before it runs (identity, authority, policy, risk), decided as allow, hold for a human, or block, and recorded as signed evidence. Unknown or error never becomes allow.

Use it

• Evidence bundle https://clawx.click/evidence/e38-proof-carrying-machine-agency-2026-09-30/

Evidence behind it

What E38 claims, and how far each claim goes

• C42-E38-ACTION-PROOF TESTED: every real governed action (kernel + E8 + E34 + E37) yields twelve signed layer proofs and one action proof binding identity, delegation, authority, policy, risk, evidence, authorization, the E8 commit, the enforcement boundary, execution, outcome and environment; a refused action yields none
• C42-E38-CLEANROOM REPRODUCIBLE: an independent verifier with no CAIN imports recomputes VALID / INVALID / INCOMPLETE / STALE / REVOKED / UNKNOWN for every published proof case and agrees with CAIN
• C42-E38-REVOCATION TESTED: revocation propagation is measured (p50/p95/p99) and a delayed domain's exposure window is counted, never hidden; no instantaneous global revocation is claimed
• C42-E38-TRANSLATION TESTED: translation to 8 formats declares every field PRESERVED / TRANSFORMED / DROPPED / UNKNOWN, never broadens scope and never upgrades a verification status
• C42-E38-FEDERATION TESTED: a second (reference) domain verifies proofs across a bridge and recognizes them as evidence only; issuer and audience confusion are refused; authority is never merged
• C42-E38-BENCH TESTED: 2141 of 2141 adversarial scenarios held; 1030 of 1030 invariants held; mutation 15 of 15; chaos: 0 of 19 faults made proof state more permissive
• C42-E38-CONFORMANCE TESTED: the 17-test conformance suite detects exactly the built-in defects of 11 reference (mock) implementations
• C42-E38-ZK NOT_VERIFIED: zero-knowledge proofs

Known limits of E38

• In-process TESTED library on one host; the second trust domain and the eleven conformance counterparts are reference/mock implementations, not real vendors.
• CAIN-GIP v2 is a reference interchange layer carried in MCP/A2A/HTTP/... messages in-process; it is not an Internet, MCP or A2A standard and no live MCP/A2A server integration was tested.
• Zero-knowledge proofs are NOT IMPLEMENTED; selective disclosure is salted commitments + RFC 6962 inclusion.
• Hardware attestation is UNKNOWN (no TEE on this host); third-party verification is NOT AVAILABLE.
• Revocation propagation is measured in-process across subscriber domains; network propagation is NOT TESTED.
• Action proofs bind governance conditions and provenance; they do not show that an action was safe, correct or truthful.

Tested guarantees in this area

Every rule in these niches has its own page with its recorded result.

• Autonomy, control loops & recovery: 407 tested invariants — Agents acting on their own, and how CAIN keeps them in bounds and recovers.
• Transactions, markets & economics: 664 tested invariants — Agents that buy, sell, bid and pay, within limits.

Related

• CAIN Agent Builder — Build new agents with governance designed in from the start.
• CAIN Agent Conformance — Check an agent against a published conformance standard.
• CAIN Agent Evaluation — Deep evaluation of agents before they are trusted with real work.
• CAIN Agent Factory — Produce many governed agents from one approved template.
• CAIN Agent Hosting — Host your agents on CAIN, governed by default.
• CAIN Agent Lab — A safe lab to try agent ideas before they touch anything real.
• CAIN Agent Labor — Rules for agents doing paid work: who did what, and who gets credit.
• CAIN Agent Marketplace — Find and hire governed agents built by others.
• CAIN Agent Organization — Teams of agents with roles, a constitution and recorded decisions.
• CAIN Agent Passport — A signed passport that says who an agent is and what it may do.