PrismPath · Open Source
A control plane for autonomous systems.
Define what an autonomous system is allowed to do. Enforce it where the system runs. Change it without rebuilding the system. Get a signed receipt for every decision.
The policy is one Markdown document a person can read. Below is a real one, running in your browser on the same kernel the conformance corpus certifies. Change a threshold, run it, and watch the route change.
Try it
The document your team reads is the graph the engine runs.
Nothing you type leaves the page. The scripted worker stands in for your model or agent; change its amount to 200 and the same ticket routes to billing instead of a person.
Write a flow, click Share; the entire flow is compressed into the URL. No server, no account, no storage. Send the link to anyone.
Consumed in visit order; {"__raise__": "msg"} throws an error.
Targets · one flow, where it runs
✓ predicates safe & parseable
| node | edge | tier | condition |
|---|---|---|---|
| classify | → human_review | deterministic | when category == "billing_dispute" and amount > 500 |
| classify | → billing | deterministic | when category in ("billing", "billing_dispute") |
| classify | → outage | deterministic | when category == "outage" |
| classify | → retention | deterministic | when sentiment == "angry" |
| classify | → general | deterministic | else |
| human_review | terminal | ||
| billing | terminal | ||
| outage | terminal | ||
| retention | terminal | ||
| general | terminal | ||
Pick a node and press ◇ Prove reachability. Proven client-side, no model, no server.
Press ▶ Run to replay the scripted outcomes.
The full playground, with semantic routing and lockfiles, is at /playground.
The problem
Nobody can point at the boundary.
Autonomous systems increasingly separate the component that produces a candidate action, a model, an agent, an optimizer, a workflow engine, from the question of whether that action is permitted. Today that boundary is spread across application code, prompts, orchestration callbacks and after the fact monitoring. Nobody can point at it, diff it, prove anything about it, or show that it held.
PrismPath makes the boundary an explicit artifact: a document a person can read, a structure a tool can verify, an image a substrate can execute, and a receipt an auditor can check. It does not own the model, agent, orchestrator, operating system or hardware underneath. It governs the transitions between them and records why.
model / agent / worker
|
| candidate outcome
v
PrismPath ---> allow | deny | abstain | human | refusal with cause
|
v
action ---> receiptThe architecture
Prove what can happen. Enforce what may happen. Prove what happened.
Before execution
Prove what can happen.
Routing is a decidable fragment, so undefined targets, unreachable steps, unbounded cycles and always false edges are caught before anything runs. Reachability under an assumption is model checked, with a witness path. Conformance across every implementation is judged by one frozen corpus.
During execution
Enforce what may happen.
Deterministic edges decide first and free, in document order. A model is reached only where meaning genuinely requires one, and low confidence abstains or escalates to a person instead of guessing. A policy takes effect only after its signature, its declared envelope and a version floor are checked.
After execution
Prove what happened.
Every decision leaves a receipt with a one byte cause code that says why it routed, refused, parked or escalated. Receipts Merkle root per session and anchor to a timestamp a third party can verify without trusting the emitter.
PrismPath is one of many control planes. What is unusual is the approach: the decision structure a person authors is restricted to a decidable, tabular fragment. The predicates are authored, never compiled from prose; the tooling checks and compiles them. That restriction is what makes everything below it possible.
One authority model, many substrates
One image, from a Python process to a chip.
The decidable fragment compiles to a table image of a few hundred bytes that carries a computed worst case bound and is signed into a pack. That one image decided the same corpus readings identically on host Python, the C reference, in the Linux kernel on two architectures, on both instruction sets of an RP2350 and on a Zynq fabric. Routes that need a model stay on the host; only the fragment travels.
The substrates in detail → one authored policy
|
signed image + wcet bound
|
+--------+-------+-------+--------+
| | | | |
Python JS/Rust eBPF RP2350 Zynq
engine /Go kernel AVR ESP fabric
| | | | |
+--------+-------+-------+--------+
|
the same decisionpredicate and flow vectors every language kernel passes: Python, JavaScript, Rust, Go
certified in the Linux kernel on every push, and on the physical FPGA fabric
cycles: the worst case witnessed on the fabric pins, inside the signed bound, over 16,009 evaluations
the whole AVR firmware. Four microcontroller instruction sets, one image
The wire
Ship the decision, not the data.
A policy depends on only some distinctions in its input. Figueroa quantization derives, from the policy text, the cells of each field that can change a decision, and a reading is sent as one symbol per cell. Any representative of a cell routes identically; that is proven in Lean 4 within a declared domain. Facet is the wire on top: self framing, Merkle rooted per packet, refusing replay by name.
The picture is not an illustration. It is the full decision space of a real policy that fuses a physical sensor with a security feed, 108 cells packed on a spiral by the engine itself, lit only where real fused decisions landed during a live capture.
1.5 B
per decision, integrity apparatus counted
66.9×
under an OpenTelemetry record of the same decision
Don't take our word for it
Every claim is a ledger row. Including the one that did not survive.
Every number on this page traces to a row in a public evidence ledger, hashed and timestamped to the Bitcoin blockchain. A pre registered comparison against OPA, Cedar, Cerbos, OpenFGA and Openlane, frozen before any comparator was installed and run to the end on real systems and hardware, found every property PrismPath builds in reachable by at least one comparator with bounded glue. PrismPath is not a layer the existing engines cannot reach, and the verdict says so.
The same table shows PrismPath native on all eight properties where no comparator is native on more than two, OPA reaching the row only with 391 lines of glue nobody ships, and on the same microcontroller about 312 KB of RAM and a 136 KB module per policy on the OPA path against a 1.7 KB interpreter class and 224 B images. Differences of degree and composition, reported straight.
Who it is for
Four people touch a deployment.
The commands, the documentation and the package are grouped by them.
The process owner
Owns the policy of record. Writes the flow and its fixture table, reviews a change as a Markdown diff with the before and after graph, never touches a compiler.
The engineer
Establishes the interface once from the flow's declared fields, calibrates thresholds for deployment, compiles and signs the pack, keeps the kernels in agreement in CI.
The operator
Runs the system day to day. Swaps and attests policy, authors short lived changes that expire by construction, reads the trail by cause code.
The evaluator
Comes after the fact. Verifies receipts against anchored roots, reads the evidence ledger, and checks the comparison that reports the claim that did not survive.
Services
The engine is open. The expertise is what you buy.
PrismPath is free, open source and conformance tested in public. Verify it first. What we sell is the team that built it, putting it around one consequential workflow with you and operating it from the kernel to the FPGA to bare metal.
Prove your decisions
We put PrismPath around one consequential workflow in your stack, so its routing and policy decisions become decidable, auditable and replayable, without replacing the models, agents or orchestrator you run.
Run it on your substrate
We port the image to your target, from the Linux kernel to an FPGA to a bare metal microcontroller, with byte identical, conformance certified behavior and measured evidence on your hardware.
Keep sensitive data home
We stand up no egress pipelines with tamper evident audit trails, built for regulated and disconnected environments, where only the decision leaves the node.