One call, before the action runs. It reads the request and decides what the agent may do with it.
Rules, then a fitted model, then language
The guard runs on every path
Platform
One call, before the action. Either it verifies, or it refuses.
Hetu is a verification layer your agent calls at the moment it wants to claim something or do something. It computes the answer deterministically where it can, labels its own confidence, and returns a record an auditor will accept.
01What gets verifiedSection 1 of 6
Three things, in this order: the figure, the cause, and the right to act.
The figure. Every number in an agent's output comes from a deterministic rule engine or a fitted causal model, never from the language model. If a figure cannot be computed from a source the system can name, it is not returned.
The cause. Attribution is a statistical result with intervals and a residual, not a sentence. It carries a confidence label computed from explained variance and interval overlap, and the narration is bound to that label.
The right to act. A verified conclusion is not automatically an authorised action. The autonomy envelope decides whether this decision type, at this confidence, at this magnitude, can execute without a named human approver.
02Where it sitsSection 2 of 6
Between the agent's reasoning and its tool call.
01
Structured in
Your agent sends a decision request: the entity, the window, the metric, the action it intends. Not a prompt — a payload against a schema.
02
Cascade runs
Rules first, causal model second, constrained hypothesis generation last. Each tier has explicit stopping criteria and escalates rather than guesses.
03
Guard checks
Temporal ordering, magnitude consistency, gate validity, sample-size floor, label match. Any failure refuses the conclusion instead of downgrading it.
04
Act, defer or refuse
The response says which of the three it is, why, and what would change the answer. Everything is written to the decision log either way.
03The interceptSection 3 of 6
One call, three ways out.
The agent asks before it acts. What comes back is a disposition, not a suggestion — and the record is written whichever way it goes.
Proved, every guard passed, inside the envelope. The agent goes ahead on its own.
Verified, but above the ceiling. It queues for a named approver with the evidence attached.
A check failed. The action is held, and the response says what would change the answer.
Act
Deterministic or statistically attributed, every guard passed, decision type inside the proven envelope.
Approve
Verified, but above the magnitude ceiling or outside the envelope. It queues with the evidence attached.
Refused
A check failed. The intended action is held, the failed check is named, and the falsification test comes back with it.
04IntegrationSection 4 of 6
One endpoint, model-agnostic, deployable inside your perimeter.
API-firstOne call per decision, before the actionStructured payloads, never raw data, to the LLMModel-agnostic narrationConfig-as-table causal graphPer-tenant autonomy envelopesIn-VPC or on-premImmutable decision log
i
The narration model is swappable and the reasoning does not depend on it, because it never did any reasoning. A model upgrade improves the sentences and changes none of the maths.
05The shape of itSection 5 of 6
A payload in, a labelled verdict out.
Nothing in the response is prose the model invented. Every field traces to a computation or a check that ran.
Request
decisiontighten_filter
entitychannel · 2 cohorts
window45 days
triggerdpd rising
Against a schema. Structured payloads, never raw data.
Response
dispositionrefused
confidencecomputed, not claimed
attribution44% · CI 37–51
recorddec_01H8ZP4K
Nothing here is prose the model invented.
In
The entity, the window, the trigger metric and the action the agent intends to take, against a schema.
Out
A disposition, a confidence label, the attribution with intervals, the guard results and a link to the record.
06In detailSection 6 of 6
The four parts, documented.
Architecture
The three tiers, their stopping criteria, and why a new failure pattern is an insert rather than a deployment.
Read on →Verification guard
Every check, what it asserts, and what happens on failure.
Read on →Autonomy & governance
Envelope mechanics, ruin thresholds, regime-change detection, recalibration.
Read on →Design partners
Bring the decision you don't currently let an agent make.
We map your constraints, seed the graph with your experts, and show you the first refusal.