Release more. Risk less.
Receipts for everything.
We sell how much of your AI you can release without a human in the loop: under an error cap that holds, with a receipt for every decision. Smarter AI is everyone's business. Permission to use it is ours.
Two kinds of organizations, one missing component
A quarter of organizations using generative AI have humans review everything before it ships: in healthcare a clinician signs every AI draft; in finance a registered principal pre-approves client communications. The savings die in the review queue.[F1]
Roughly as many review almost nothing[F1], and employees run AI on private accounts, outside the company's sight. Blind trust: the risk is carried, unpriced.
Both lack a floor: a mathematically held limit on what may go out automatically, and proof of what happened. The first group uses the floor to release more. The second, to bring the AI already in use under one roof. (We don't see traffic outside our pipes. We make sneaking uninteresting.)
What you get: one number the board understands, the share of cases that run on autopilot, and a promise that holds: at most this many errors get through. In writing.
What counts as an error?
You decide. An error is an answer your own standard would have stopped: a wrong amount, an invented source, a promise you're not allowed to make, personal data in the wrong place. During onboarding your reviewers' decisions become the ground truth; the definition is written in plain language, split into severity classes with separate caps, and versioned. Every receipt states which version applied.
And the line is clear: we never promise the AI is right about the world. We promise the share of violations of YOUR standard stays under the cap, provably, after the fact.
From connection to receipts, in five steps
Connected in a day
One address change in your API call. Your existing guardrails stay: they become our input signals.
Silent onboarding
Two to four weeks in which nothing ships automatically. We measure where your AI is right, per case type, against your error definition.
Calibration with a guarantee
From your own data we compute a limit per case type so the cap you chose (at most 5 errors per 100 released) provably holds. Not “usually holds”. Holds. How, is proprietary. It is the core of the company.
Three outcomes in production
Release, release with limitation (e.g. mandatory source citation), or escalate to a human. The middle lane replaced escalation that cost 5–10x more in our tests, at the same measured error cap.[F2]
Receipt and guard
Every decision in a signed, unbroken chain: change one byte and the verifier points to where. If your vendor swaps models, the system alarms, steps itself down and demands recalibration.[F3] The guard is genuinely sensitive: in testing it exposed a real calibration error in our own settings, corrected and confirmed.[F4]
Autopilot, prioritization, safety net
Release under an error cap, where the law allows.
Where review is mandatory (healthcare, finance) no signature is removed: we certify the fast lane and point out the three drafts in twenty where the errors sit. The clinician's fifteen minutes land where they matter. The US financial regulator is itself moving from “review everything” to risk-based selection.[F1] Selection without a held error cap is guesswork; we are the math behind the selection.
The guarantee on what we do NOT flag: a second pair of eyes that never tires. We do not certify that manipulation gets caught. We certify that the false-alarm guarantee cannot be gamed, even by an adaptive counterparty.
An insurer, 10,000 drafts a month
An insurer runs AI in draft mode: 10,000 drafts a month, every draft approved by a human before sending. At a 5% error cap, 85–94% went straight through in our tests.[F5] The queue fell to a fraction. We promised at most 5% false alarms; the measured outcome was 4.0–4.4%.[F6] And internal audit gets a receipt chain instead of weeks of log archaeology.
Who pays: the COO/CFO, from the operations budget (review hours freed this year). Compliance becomes the deal's yes-sayer, thanks to the receipts.
Why us: others hand you a score, “0.87”, and leave the interpretation to you. We hand you a promise, “at most 5 in 100”, and the proof that it holds.
Demo in fifteen minutes: flip one byte in a chain → the verifier points to where; simulate a model swap → the system steps itself down; see the autopilot number. Then: two weeks of passive measurement on your traffic → your own number, free.
Keep everything. Add the promise.
Your guardrails, eval tools and dashboards stay: their scores become our inputs. Score tools answer “what does this answer look like?” We answer the next question: “may it go out — and can the decision be proven afterwards?”
That layer adds four things score tools don't give you:
1. Error caps that provably hold, per case type
Promised at most 5%, measured 4.0–4.4%.[F6]
2. A decision policy, not just an alert
Release / release with limitation / escalate, with budgets that protect your reviewers from drowning.
3. Signed receipts with approval semantics
Who approved, under which policy, at which error cap. Third-party verifiable, without access to us.
4. A guard that may look continuously
False alarms at 1.7–4.0% where check-every-time methods run up to 57%.[F10] When several safeguards are combined, the receipt ensures the guarantees are combined correctly. The wrong way broke the promise ~10,000-fold in our stress test; our system does not permit that mistake.
Many can measure. Promise, decide and prove: that's the layer we add.
The Autopilot Rate, over time
Error-capped release on your traffic: release, limit, or escalate, with a receipt for every decision and a guard that recalibrates.
The fleet view: per-department caps and budgets on one screen, severity classes with separate caps, and a deeper prioritization mode for sectors where review is mandatory. And the agent track, the flight-recorder capability of the same engine: every agent action receipted, signed and chained; start receipted, graduate to caps. For agent teams →
Automation capacity managed like any other budget: allocated against certified risk, spent deliberately, accounted for on receipts. And the insurance bridge: the same receipts and meter as the continuous evidence that makes AI risk insurable. For insurers & brokers →
A promise costs more than a score. That's the point.
Price follows the risk level: the tighter the cap, the higher the price. Liability scoped like an auditor's, insurable like an auditor's, and the promise itself can be reinsured.
See your autopilot number
Fifteen minutes of demo, then two weeks of passive measurement on your traffic: your own number, free.