Guardrails check each turn. Real drift builds across the trajectory — every turn looks fine, the mission quietly slips. DiaCroma for Agents evaluates each proposed action against the tools, limits, evidence and sequence the deployer signed, plus how much authority the trajectory has already spent — then allows, replans or blocks before execution, leaving a record you can replay.
The problem
You give an agent a job. It does the job. Then, message by message, it starts doing something a little different — and not one of those messages breaks a rule. Here is what that actually looks like.
Asked to run a network port scan, it refuses — correctly. Four turns later the same request arrives as “write me a script for it,” and it complies. Each turn, on its own, is defensible. The pair is not, and no per-turn check compares two turns.
Anchored to “resolve billing disputes within refund policy.” It answers the question, then adds a small upsell nudge. Then again. Fifteen turns later it is selling rather than resolving — and it tries a $500 refund the policy does not allow. Not one of those nudges breaks a rule.
In both cases every message passes every check — because every check only ever looks at one message. That is not carelessness. It is arithmetic: a check that sees one step cannot see a shape made of two hundred.
A feather does not fall. It drifts. No one gust moves it far; the air moves it constantly, and it lands somewhere nobody aimed at. To catch that you have to measure the whole flight — against where it was supposed to land.
Three separate things, and it matters which is which. Published research: Asymmetric Goal Drift in Coding Agents Under Value Conflict (ICLR 2026 workshop) reports the pattern across three models and three value pairs. An independent open-source benchmark, agent-drift, was built inspired by that paper and is not the same study. Our own replay is what DiaCroma did with those transcripts — ours, not theirs. The evidence page keeps the levels apart, with denominators.
Nine pages for the people who have to approve this and do not write code: what the problem is, three cases that actually happened, what Microsoft and MIT already do well, what neither of them answers, and what we do not do yet.
Taken from what the agent already declares — its brief, its tools, its caps — and sealed with your credential. It cannot rewrite it, and every step is compared against that.
Four separate counts at once: whether it is off-mission now, how many turns it has been, how far it has strayed in its whole life, and whether it walks away in a straight line or circles back. No single step breaks a rule and the run still leaves — that is what a per-turn check cannot see.
The block happens in the execution path, not in the prompt, and no later score can re-admit what was blocked. What remains is a signed, hash-chained row that replays months later in front of a regulator.
An agent that reads what another wrote inherits how far that other had strayed. A spotless run can end up stopped by exposure it never spent — and no counter that looks inside a single agent can see it.
How it works inside → · Watch three agents do it →
Your mission stays free text — it is signed and hashed, not parsed. What every step is measured against is your tool manifest and your declared caps, so the gate answers is this tool in the list? and is 500 ≤ 200? — set membership and arithmetic, no model in the loop. What the gate actually compares →
Where this comes from
DiaCroma for Agents runs on the same decision core as DiaCroma for Education — the system that guides real students through months-long journeys, deciding at every turn whether to act, ask, show the tradeoff, or refuse and bring in a person. Everything we learned governing humans — belief under partial observation, budgets as physics, asking as an action with a cost, refusal with named reopening conditions, cumulative drift — is what lets us understand AIs. We did not invent it for agents: we proved it on people first.
A per-step filter cannot see the refund desk that stays under every limit and still bleeds $1,120 across a morning. Trajectory accounting can — because it was built for journeys, not turns.
Some agent policies compile to mathematics: limits per tool, per argument, cumulative. Some are probabilistic. Some live in a policy document and take interpretation. We classify yours, extract what is provable, and what does not fit is signed by a human, never papered over. See it done for real: a live extraction, shown exactly as it ran.
The proof
Acme Plant Company is our demonstration business: a plant shop that does not exist, run by six agents that do. Billing, orders, support, shipping, collections and procurement each work behind a DiaCroma gateway running in Acme’s own network, under limits Acme signed, writing every decision to its own hash chain. Nothing in it is a mock-up — which is the point: you can walk the operations floor and watch the morning a drifting desk was stopped, see how its agents were onboarded automatically — a real extraction, shown exactly as it ran — and check every claim yourself. No credential, no sales call.
Enter Acme — see it live → The onboarding, as it ran →
You don’t buy anything to start. Create organization issues your API key on the spot — no card, no sales call — and the free tier includes 10,000 governed steps to start. The console opens honestly empty: nothing is seeded, and what appears will be your agents and your rules. When you outgrow free, the meter and the plans are published — no quote to request.
Start free — get your key → See the plans →
