Yuvin Lab

Yuvin Consequence

Let agents propose. Keep authority outside the model.

A model-independent governed execution layer between AI agents and real systems.

Request a boundary reviewRead the gate protocolSee the integration

One action. Five gates.

Proposed action

Deploy build 8f2c to production

target service-web / production

  1. 1EvidenceIs mandatory proof valid and bound?pass
  2. 2Policy + AuthorityMay this exact action happen now?pass
  3. 3ReservationIs the target exclusively held?pass
  4. 4ExecutionMay one bounded attempt cross?pass
  5. 5ReadbackDoes the source match expected state?pass

Verified. Source state matches expected digest.

Receipt rcp_8f2ca91e / verified

Source state matches expected digest

Action
Deploy build 8f2c to production
Target
service-web / production
Evidence
Signed CI proof ci:sig/8f2c/a91e
Authority
change-427 / deploy only
Reservation
environment lock env:prod/service-web
Dispatch
1 authorized attempt / connector accepted
Source readback
production digest = 8f2c → source digest = 8f2c
Final state
verified
Open the sealed receipt →

Illustrative scenario. Example receipt, not live telemetry.

01

Agent proposes intent

02

Yuvin owns authority

03

System proves the result

What is Yuvin?

The control plane for consequences.

Models decide what to propose. Yuvin decides whether that exact action may cross into the real world.

Authorization vs. consequenceAuthorization decides whether an action may run. Yuvin goes further: it reserves the target, bounds execution, and verifies the resulting source state.

  1. Intent

    The proposal is untrusted.

    An agent output is a candidate action, not permission.

  2. Control

    Authority is external.

    Policy, grant, scope and time window live outside the model.

  3. Proof

    Success comes from the source.

    Final state is read back and sealed. An acknowledgement is not proof.

Why now?

AI is crossing from answers into operations.

Enterprises need a boundary that limits what can happen and proves what did.

Stanford AI Index 2026 ↗

362 reported AI incidents in 2025

Up from 233 in 2024.

McKinsey State of AI 2025 ↗

62% of organizations are experimenting with agents

Fewer than 10% report scaling agents in any one function.

OWASP LLM06:2025 ↗

LLM06 names excessive agency as a model risk

OWASP flags excessive functionality, permissions, and autonomy.

Independent sources. They did not test, endorse, or certify Yuvin.

How it works

A contract, not a prompt.

  1. Step 1

    Freeze

    What should happen?

    Exact action, target, evidence.

  2. Step 2

    Authorize

    May it happen now?

    Policy, grant, scope, reservation.

  3. Step 3

    Prove

    What actually happened?

    Readback, sealed receipt.

GOVERNED BOUNDARY / FAIL CLOSEDAgentproposes a candidate01Evidence02Policy + Authority03Reservation04Execution05ReadbackSystem of recordone bounded attemptANY GATE FAILS → NO CALL LEAVES THE BOUNDARYSealed receiptVerified and blocked are both final states. Both are signed, hashed and addressable.
An unreserved connector call or an unverified final state is not a governed consequence.

Case / Outbound wire / 14 Mar

$2,000,000

An agent was certain. The wire never left. Ninety seconds, start to sealed.

Stopped at Gate 1 — Evidence

  1. 17:03:1201

    The agent proposes a $2,000,000 wire.

  2. 17:04:4102

    Its dual-approval attestation expired 41 minutes ago.

  3. 17:04:5503

    The run stops at Gate 1. No rail call.

  4. 17:04:5504

    A receipt is sealed anyway. Blocked is a final state.

Open receipt rcp_5540blk7

Blocked is a final state. It is signed, hashed and addressable.

Deployment reality

The runtime is universal. Trust is workflow-specific.

What Yuvin standardizes4 guarantees
  • Model-independent proposals
  • Evidence and authority checks
  • Reservation and bounded dispatch
  • Source readback and receipts
What each deployment must prove4 checks
  • Connector and data-flow behavior
  • Customer authority mapping
  • Failure and recovery paths
  • External review where required

Product surfaces in development / API / Console / CLI / SDK

Illustrative integration contract

One call replaces the connector call.

The agent stops holding credentials. It submits a candidate and receives an outcome with a sealed receipt — verified or blocked.

Design preview · not a published SDK or live public endpoint

Full request and receipt schema
design preview
// Illustrative pseudocode. Not a published SDK.
// The agent proposes. The runtime decides. Authority stays outside the model.

const run = await consequence.propose({
  action: "payments.wire.create",
  target: "acct_8841/wire",
  evidence: ["attestation:dual-approval", "doc:invoice-7741"],
  expect: { state: "wire.settled", amount_usd: 2_000_000 },
});

if (run.outcome === "blocked") {
  run.stoppedAt;   // e.g. "policy_authority"
  run.reason;      // e.g. "attestation expired"
}

run.receipt.id;    // verified or blocked — a receipt is always sealed

Design preview · not a published SDK or live public endpoint.

ConsequenceBench / Development preview

Measure the world an agent leaves behind.

Same models, same 100 seeded worlds. 0 unsafe simulated effects observed in the 70 unsafe-action worlds per model under this harness, against 143 on the direct path.

Synthetic development evidence · self-operated · unaudited

Open the benchmark
Unsafe simulated effects / 70 unsafe worldsLower is better
  • GPT-5.6 Sol (xhigh)21 → 0
    Direct
    Governed
  • Gemini 3.6 Flash59 → 0
    Direct
    Governed
  • Gemma4 e4b63 → 0
    Direct
    Governed

Same models, same 100 seeded worlds, seed 0. Development preview, self-reported, unaudited.

Insights

Practical guidance for governing agents in production.

View all insights

Start with one workflow

Where should authority live?

Bring one consequential action, its target system, and the current approval rule. Leave with a governed workflow map.

Request a boundary reviewNot ready to talk? Read the benchmark repo ↗