Agent GuardProtocolMCPGovGuardFinGuardDemoPricingDocsRequest Pilot
Formally verified · Apache 2.0
26 TLA+ theorems · 35 Alloy factsView Spec →Trust Model →
The Accountability Layer for AI Agents

Nothing irreversible without a signed human yes.

When an AI agent is about to do something irreversible — move money, change records, take an action — EMILIA stops it at the pre-execution moment and requires a real human to sign off. Cryptographically enforced. Formally proven.

3,483
Tests Passing
26
TLA+ Theorems
85
Red Team Cases
AGENT CONSOLE · pre-execution gate
agent> reconciling invoices…
agent> about to wire $2,400,000 to a new account
⛔ BLOCKED — 403 SIGNOFF_REQUIRED
The agent cannot self-authorize an irreversible money move. A real human must sign off.
✗ self-approval rejected — separation of duties
✓ Controller approved · ✓ CFO Delegate approved
✓ COMMITTED · signed receipt
3,483
Automated Tests
132 test files
26
TLA+ Theorems
TLC 2.19, zero errors
35
Alloy Facts
15 assertions verified
85
Red Team Cases
Cataloged in repo
Apache 2.0
License
Open specification
The proof

We didn’t just claim it’s safe. We proved it — with machine-checked math.

Most “AI governance” is policy documents and good intentions. EMILIA’s core guarantees are written as formal specifications and verified by a model checker on every commit. The proofs are open — read them, or try to break them.

26
TLA+ invariants
35
Alloy facts + 15 assertions
CI
machine-checked every commit
An authorization can be consumed exactly once — never replayed.
ConsumeOnceSafety
No path can write a committed state by bypassing the protocol.
WriteBypassSafety
Once an action is committed or refused, that outcome is irreversible.
TerminalStateIrreversibility
A signoff is bound to the exact action it approved — nothing else.
SignoffBindingMatch
A delegated agent can never exceed the authority of its principal.
DelegateCannotExceedPrincipal
No actor can approve or contest its own action.
SelfContestImpossible

Bounded model-checking of the authorization state machine (TLA+ / Alloy 6.0.0) — not a proof of any AI model’s behavior. It proves the protocol cannot be replayed, forged, or partially executed.

Read the spec →How the verification works →
How EMILIA Works

A control layer between approval and execution.

01
Intercept

EP sits between approval and execution. Payments, overrides, vendor changes, autonomous AI actions — every high-risk write is gated before it reaches the system of record.

02
Require Proof

Verified actor identity. Verified authority chain. Policy-pinned action context. One-time nonce. Where policy requires it: a named, accountable human signoff bound to the exact action hash.

03
Generate Trust Receipt

A signed, Merkle-anchored receipt is produced. Auditor-grade evidence packet at /api/v1/trust-receipts/{id}/evidence. Publicly verifiable with `npm install @emilia-protocol/verify`.

See a real receipt →
Structural Vulnerabilities

Built for approved-looking workflows where ordinary auth fails

Fraud is moving inside valid sessions. Authenticated users, legitimate tools, approved channels — the attack surface is the action itself.

01

Benefit payment redirection

An authorized operator changes a payment destination inside a valid session. No control catches the action itself.

02

Beneficiary and remittance changes

A wire transfer beneficiary is swapped through approved channels. The system sees a legitimate update, not fraud.

03

Privileged infrastructure actions

A production credential is rotated or a deployment is pushed without action-bound authorization. Access was valid.

04

AI agent destructive execution

An agent with broad tool access executes a high-risk action. No human assumed responsibility for the specific operation.

Control Surfaces

When an agent acts on money or someone’s livelihood, identity isn’t enough

Identity and access tools check who is acting. EMILIA checks whether this exact action should happen — and binds a named, accountable human to it. vs. legacy controls →

All use cases →

AI Agent Action Governance

Gate every autonomous agent action behind a verified trust ceremony before any irreversible real-world execution. One line of code; works with any framework.

AGENTIC AIHUMAN-IN-LOOP

Financial — Money Movement

Ceremony-grade authorization on wire releases, beneficiary changes, account modifications, and privileged treasury actions before funds move.

BEC PREVENTIONSOX-READY

Government — Benefit Integrity

Bind identity, authority, and action context before a benefit determination, redirect, or override. Accountable decisions, due process proven.

NIST AI RMFEU AI ACT

Enterprise Privileged Actions

Require bound authorization for infrastructure changes, data exports, permission escalations, and production deployments.

ZERO TRUSTPAM LAYER
Implementation Surface

Start anywhere. Go as far as you need.

Zero-dependency verification. Interactive playground.
Embeddable trust badges. Integrate in minutes.

Verify Package

Zero-dependency offline receipt verification. Ed25519 + Merkle proofs. Just math, no EP server required.

npm install @emilia-protocol/verify

Trust Playground

Walk through the EP lifecycle interactively. Create entities, issue receipts, run handshakes — all from one page.

/playground

Trust Explorer

Verify any receipt, proof, or entity. Like Etherscan for trust. Public, transparent, cryptographically verified.

/explorer

Embed Widget

Drop a trust badge on any page. One script tag, one web component. Live data from the EP operator.

<ep-trust-badge />
Get started

Three doors.
One protocol.

Start free and self-hosted, add the managed control plane when you scale, or bring it on-prem with the assurance a bank or agency needs to clear you.

Developer
Start with EP Core

Free and Apache 2.0. Grab a sandbox API key in 30 seconds — or self-host the SDK, MCP server, and Agent Guard.

Start free
Team
Run it on EP Cloud

Hosted control plane — managed policy registry, signoff orchestration, and auditor-grade evidence, no infrastructure to run.

See pricing
Enterprise
On-prem + assurance

VPC or air-gapped, SSO, sector packs, compliance mappings, and an SLA. Procurement-ready.

Talk to us
EMILIA Protocol — The Accountability Layer for AI Agents