Agents may suggest anything. They may only do what the machine allows.

Reasoning is probabilistic. Consequences should not be.

“We stopped asking the model to be careful. We made carelessness impossible to execute.”

A language model is a remarkable planner and a poor custodian. It can read a messy invoice, notice the vendor changed banks, and draft a sensible payment. It can also, on a bad afternoon, invent a tool argument or follow an instruction smuggled into a PDF. Prompting harder does not change that. Architecture does.

So we split the system in two. The model works in a plane where nothing it writes has effect. Its output is a proposal: plain data. Authority lives in a finite-state machine that knows every legal transition in advance, checks each proposal against policy, runs it in a sandbox, and commits only what it can prove.

Elena Rostova · Chief Systems Architect

Step through a real trace, then try to break it.

Below is a treasury agent settling a vendor invoice. Press Step to walk it through the five stages every Skyla action takes: plan, policy gate, sandboxed tool call, cryptographic receipt, commit.

Then switch on a violation and run it again. Each fault halts the trace at a different stage, and in every case the committed ledger stays exactly where it was. The machine never needs to undo anything, because nothing unauthorised ever reaches the ledger.

Two planes, one direction of authority.

Agents in the upper plane can talk to each other freely. A planner drafts, a critic objects, a reporter explains results to people. None of them holds a credential. When they want something done, they hand a typed proposal downward.

Everything below the line is ordinary deterministic software. The gate consults capability tokens issued for this run. The sandbox gives tools a copy-on-write view of the world. The receipt step confirms that what ran is what was approved. Denials flow back up as structured feedback, so the planner can try again inside the rules.

What we promise, stated so it can be checked.

• G1
  No ungated mutation. Every write to customer state is preceded by a gate verdict of admit for that exact payload digest.
• G2
  Bounded execution. Each machine has finitely many states, and every non-terminal state carries a timeout. Runs end.
• G3
  Faithful replay. Given a ledger, the runtime re-derives every transition and reaches the same final state, or raises a divergence alarm.
• G4
  Fail closed. If the gate, signer or ledger is unreachable, the machine waits or halts. It never proceeds on a guess.

G1, G2 and G4 are model-checked in TLA+ on every release. G3 is tested by continuously replaying a sample of production ledgers.

Built for work where an apology is not enough.

Our customers move money, place clinical orders and change production infrastructure. In each case the cost of one wrong action dwarfs the cost of a slower right one, and a regulator will eventually ask what happened and why.

Skyla sits between your agents and your systems of record. You keep your models and tools; we supply the gate, the sandbox, the replayable ledger and the harness that proves it all holds.

Read the specification, then bring us a hard case.

Start with the runtime architecture to see how state machines and capability tokens divide the work. The policy guardrails chapter shows how invariants and quotas are written. The benchmarks report what happened across fifty thousand trajectories, including where we still fall short.

If you have a workflow that keeps you up at night, write to us at [email protected] or use the engineering inquiry form.