An agent that fails loudly is an inconvenience. An agent that fails quietly, with a high confidence score attached, is the one that ends projects. This page explains the seven checks that run before an agent writes anything.
An OCR system misreads a thousands separator as the digit 1. An invoice total becomes ten times larger than it should be. The model reports 99% confidence. The agent posts it. The error surfaces weeks later, in someone's accounts.
This is the failure that ends projects, and confidence scores will never catch it — the model is certain, and wrong.
The validation layer checks arithmetic instead. Line items must sum to the subtotal. Subtotal plus tax minus discount must equal the total. When a separator is misread, that identity breaks. The run stops.
It costs microseconds and zero tokens, because arithmetic does not have opinions.
Each layer catches a different class of error. They run in order, and a failure at any layer stops the run.
Every value is traced to its source: the document, the page, the position it came from. A reviewer can follow any number back to where it originated.
Totals, subtotals, tax and discounts must satisfy their identities. Arithmetic that fails to balance halts the run regardless of how confident the extraction was.
Values are checked against expected ranges for their field and their history. An order of magnitude out of pattern is flagged before it travels further.
Structured identifiers such as tax numbers, account codes, dates and currency fields are validated against their own rules and check digits.
Critical values are extracted twice by different methods. They must agree exactly. Disagreement routes to review rather than to a system of record.
Human review is triggered by the amount at risk. A low-value routine item clears automatically. A high-value item waits for a person, every time, whatever the model reports about its own certainty.
Every decision is logged at the point it is made, in a form that can be replayed from the trail alone. An operator can stop the agent instantly, mid-run.
A hard cap sits in the runtime and is evaluated before every model call. A cap checked after the spend is an alert.
Agents are defined by configuration, so a second agent starts from a working foundation. The validation stack is inherited, so governance does not get re-implemented per build.
Much of the AI governance market uses a model to evaluate a model. That produces an opinion about an opinion, and it varies between runs.
Given the same inputs, deterministic checks return the same result. They can be unit tested, versioned, and reviewed by an auditor who has never seen a language model. This is what makes a run replayable years later, and it is why the CAIRO Protocol runs governance in code.
Fifteen minutes, a live system, and a straight answer on whether it fits what you're building.
