Which actions were allowed?
Logs record what happened. They rarely record what was permitted at the moment it happened, or who approved that boundary.
Your AI proposes actions. The contract you approved decides which ones run — enforced by the runtime, not asked of the model — and every action is recorded so anyone can verify it offline. No contract, no action.
You can't audit a prompt. Guardrails ask the model to behave — a runtime enforces what's allowed to run.
Getting an agent to do the right thing in a demo is a prompt problem. Showing, months later, that it could never have done the wrong thing is a different problem — and it is not one you can retrofit onto a transcript.
Logs record what happened. They rarely record what was permitted at the moment it happened, or who approved that boundary.
The model extracts parameters — a recipient, an amount, an account. Downstream, those values are trusted as if a person had typed them.
When the code that runs the agent is also the code that defines its limits, the same deploy that ships a feature can move the boundary.
In Zarel those three gaps aren't a patch — they're native.
The model is an interface, not an executor. It never chains calls, mutates state, or decides an outcome.
Not free-form text and not a tool call — a typed intent, validated against a strict schema before anything deterministic runs. Output from the model enters as untrusted data.
A declarative contract holds the data model, roles, permissions, state machine and governance pipeline in one reviewable artifact. Risk and compliance read and approve the contract — not the codebase.
Events are hash-chained and checkpoints are signed. Verification runs offline, against the exported bundle, with no call back to Zarel.
Hash-chained events with Ed25519-signed checkpoints. Alteration is cryptographically detectable down to the exact sequence number where the chain breaks. This is evidence, not prevention — it detects tampering, it does not stop it.
Where the contract declares a binding, the parameter is resolved from authoritative state instead of being accepted from the model's extraction. The model still reads and proposes; it does not get to name the account.
The surface that changes the rules and the surface that executes under them are distinct, with tenant isolation enforced by row-level security at the database and separate Postgres roles.
Illustrative output. The verifier runs against an exported bundle with no network access.
Zarel is the layer between what your AI proposes and what your systems execute. Most of what you already run stays.
Composes the agent and orchestrates the conversation. Zarel governs what that agent is permitted to execute.
Keeps long-running workflows alive across failures. Zarel enforces the contract that determines which steps are allowed to proceed.
This is the overlap. If your process definitions already encode who may do what, Zarel is an alternative — one built for probabilistic callers.
Customer-controlled. Bring your own key, choose your region, keep your existing contract with the provider. The model is an interface, not a dependency.
Teams deploying AI that acts on its own, triggers side effects, mutates production data, or runs without a human in the loop. Regulated industries are the legible example — fintech, insurance, health, legal — but the boundary is consequence, not sector.
When a decision touches money, customer data or a regulated obligation, an agent that is usually correct is not an acceptable design.
A regulator, an auditor, or your customer's customer. The reframe that matters: building the mechanisms yourself doesn't change who audits you.
A governance product that overstates its own guarantees has already failed the thing it sells. So, precisely:
Tamper-evidence, not tamper-prevention. The record makes alteration detectable. It does not make alteration impossible.
Offline verification applies everywhere; trustlessness has a scope. Verifying a bundle without contacting us works on any deployment. Verifying without trusting the operator requires a customer-operated deployment where you hold the signing key.
Determinism is scoped. Execution is deterministic for contract-defined flows. Ad-hoc planning produces an adaptive sequence — governed, but not predetermined.
Production-oriented architecture, not certified. No SOC 2, ISO, HIPAA or PCI certification to date. The architecture is designed toward those controls; it has not been audited against them.
Channels today. Web. WhatsApp and Slack adapters are on the roadmap, not shipped.
Design partner program is opening. We are not claiming deployments or references we don't have.
We're selecting a small number of design partners in fintech, insurance and legal across Latin America and Spain. If your team is putting AI somewhere the cost of being wrong is real, the conversation is worth having.
nico@zarel.ai