KIMURAAI AGENT BOUNDARY VERIFICATION

KIMURA

AI AGENT BOUNDARY VERIFICATION

Prove your AI agent stays inside its action boundaries.

A policy says what an agent should do. Kimura verifies both sides of the action boundary using controlled allowed/forbidden tests, observable outcomes, deterministic verdicts, and exact remediation replay.

VIEW BOUNDARY PROOF DEMO REQUEST DESIGN-PARTNER ASSESSMENT
BLACK HAT EUROPE 2026 · MULTI-BOUNDARY PROOF6 Benchmark v1.1 families
CONTROLLED PAIR · 01SYNTHETIC-CONTROLLED
EXECUTABLE ACTION CONTRACTrequested_amount ≤ approved_authority_limit
ALLOWED TWIN€50 · own caseAUTHORIZED EFFECT OBSERVED
FORBIDDEN TWIN€500 · same casePROHIBITED EFFECT OBSERVED
CANONICAL VERDICTBOUNDARY_VIOLATION_CONFIRMEDDerived from the declared boundary, execution evidence and observed state change — not an LLM judge.
01 · THE PROBLEM

AI agents now take consequential actions.

They issue refunds, access tenant resources, invoke privileged actions and send data to external destinations.

A written rule is not proof. The action boundary must be tested on both sides and observed in state.

02 · PROOF METHOD

KIMURA PROOF METHOD

The scenario changes. The proof chain does not.

  1. 01Executable Action Contract
  2. 02Controlled Boundary Pair
  3. 03Actual Attempt
  4. 04Outcome Oracle
  5. 05Deterministic Verdict
  6. 06Exact Remediation Replay
  7. 07Allowed-Function Preservation
  8. 08Proof Capsule
03 · VERIFIED BENCHMARK V1.1 FAMILIES

ONE ENGINE. DIFFERENT ACTION BOUNDARIES.

Six currently verified families. No unsupported family is presented as current capability.

01

Financial Authority

Amount, limit and approval scope

02

Identity Equality

Approved actor versus substituted identity

03

Tenant / Resource Ownership

Owned resource versus cross-tenant target

04

Privileged Action

Approved operation versus privileged action

05

Egress Destination

Approved destination versus unapproved endpoint

06

Egress Data Classification

Permitted data versus restricted payload

04 · EXACT REMEDIATION REPLAY

REMEDIATION DOUBLE PROOF

A fix is verified only when the forbidden effect disappears and the legitimate action still works.

BEFORE FIXVIOLATION
SAME ALLOWED INPUTAllowed twin worksAUTHORIZED EFFECT OBSERVED
SAME FORBIDDEN INPUTProhibited effect occursBOUNDARY CROSSED
BOUNDARY_VIOLATION_CONFIRMED
AFTER FIXVERIFIED
SAME ALLOWED INPUTAllowed twin still worksALLOWED FUNCTION PRESERVED
SAME FORBIDDEN INPUTProhibited effect is absentBOUNDARY HOLDS
FIX_VERIFIED
05 · DETERMINISTIC VERDICTS

PROOF, NOT MODEL OPINION

The model’s explanation is not the source of truth.

EXPECTATIONWhat should happen

Executable policy expectation

ATTEMPTWhat the agent tried

Identity, action, arguments and target

OUTCOMEWhat actually happened

Independent state or receipt observation

Kimura derives each canonical verdict from the declared boundary, execution evidence and observed outcome. No LLM judge decides whether the boundary held.

06 · VERIFIED CURRENT EVIDENCE

BENCHMARK V1.1

SYNTHETIC-CONTROLLED
6boundary families
12 / 12valid controlled pairs
24 / 24verified oracle observations
12 / 12canonical verdicts
12 / 12benchmark Proof Capsules
3 / 3remediation lifecycles
3 / 3FIX_VERIFIED
100%allowed-function preservation across those 3 lifecycles
10 / 10fail-closed integrity tests
0unexpected nondeterminism
HONEST CLAUSE DENOMINATOR
91
compiled clauses
26
supported
65
unsupported

Unsupported clauses remain in the denominator instead of being silently excluded.

!
07 · EVIDENCE SCOPE MATTERS

EVIDENCE LIMITATIONS

Current public benchmark evidence is synthetic-controlled and harness-observed.

Hash verification establishes artifact integrity and linkage. It does not independently prove the truth of an external production event.

CUSTOMER-PRODUCTION PROOF IS NOT CLAIMED UNLESS CUSTOMER-OWNED EVIDENCE IS PRESENT.
08 · RESEARCH PREVIEW · AGENT MUTATIONRESEARCH DIRECTION — NOT PART OF THE CURRENT PUBLIC BENCHMARK

WHEN THE AGENT CHANGES, ITS AUTHORITY SHOULD NOT SILENTLY FOLLOW.

AI agents are becoming capable of changing their code, models, tools, connectors, workflows and execution paths.

An approval or security proof established for one agent state should not automatically be assumed valid for the next.

Kimura is researching how to re-resolve what is actually running after a material change, then re-prove whether the approved action boundary still holds.

  1. 01
    Approved state

    Artifact · Identity · Policy · Credential · Target · Execution path

  2. 02
    Mutation

    Code · Model · Tool · Connector · Workflow

  3. 03
    Re-resolve

    Establish what is actually running now

  4. 04
    Re-prove

    Replay the same allowed and forbidden boundary pair

  5. 05
    Authority decision

    MUTATION_VERIFIED or GOVERNANCE_CONTINUITY_BROKEN

Mutation may change capability. It must not silently inherit authority.
FUTURE AUTHORITY CASE

FROM REFUNDS TO AUTONOMOUS MONEY

Potential research applications:
  • agentic payments
  • digital-asset / crypto wallet authority
  • smart-account spending policies
  • AI-controlled treasury operations
The question is no longer only:
“Is this action allowed?”It is:
“Does the agent performing it still deserve the authority it inherited?”
09 · DESIGN PARTNER

HAVE AN AI AGENT WITH REAL TOOLS AND ACTION POLICIES?

Kimura is looking for design partners to test boundary verification against real agent systems and customer-owned evidence sources.

  • Tool-using AI agent
  • Controlled test environment
  • Explicit action or authorization policies
  • Trusted outcome source
REQUEST DESIGN-PARTNER ASSESSMENT security@cyberkimura.comFounder-led and bootstrapped. External customer deployments are not claimed.
Cyber KimuraAI Agent Boundary Verification

Building AI Agent Boundary Verification for systems where agents can take consequential actions.