The human answers for the agent. xChk keeps the record.
xChk licenses an AI agent to an accountable person, checks every consequential action against what that person allowed, asks a human when the answer is not already on file, and seals the whole story on a chain anyone can recompute. Runs anywhere; answers the same.
Works with Claude Code, Cursor, Codex, Antigravity and Hermes today. Nothing your agent produces leaves your machine except the proof.
What it does
Four things, each of which leaves evidence.
Licenses agents to people
Every agent carries a plate bound to a verified human principal and a grant sheet: which areas it may act in, up to what amount, and where a human must be asked first.
Gates every action
A hook in the agent's own harness authorizes each tool call before it runs: allow, ask a human, or refuse. Fails closed when the registry cannot be reached.
Puts a human's answer on the record
Approvals are a passkey ceremony on your phone, with the request in front of you. The decision, the approver and the time are sealed with the action.
Keeps a dashcam
The host's own record of what ran is reconciled against what the registry authorized, so an action that happened but was never recorded becomes evidence, not absence. Emergency stop included.
How it works
Install once per machine. The agent keeps working; the record starts.
Register a plate
Create a licence for the agent and name the human who answers for it. Set the grant sheet.
Install the gate
One command wires the hook into Claude Code, Cursor, Codex, Antigravity or Hermes and starts the resident manager that keeps the machine honest.
Work as normal
Routine actions pass. Consequential ones reach you as a text or a card on your desk, and wait for your passkey.
Prove it later
Export a self-verifying Black Box Report for any window. It recomputes every hash offline when opened.
Verified people, the same way
xChk has two tracks on one method. The agent track above licenses an agent to a person. The people track checks that the person is who they say they are, live, at the moments impostors target, with the same record and the same proof.
Remote interviews
Deepfaked candidates, AI-coached answers and bait-and-switch. A live check on the candidate's own phone during the call, and a named interviewer's verdict on the record.
Helpdesk callers
A caller asking for an MFA reset or access is verified before the agent acts: video, liveness, location, device and network, or a passkey bound to someone already verified.
Hire to start
The person who starts work is checked against the person who was hired, so a substitution between offer and day one shows.
Employee audits
Checks on current remote staff: who is actually doing the job, with a proof link the auditor can verify without trusting us.
Identity is facets proven over time: government ID, company sign-in, passkeys, work history, live check, track record. The same verified person is the one on an agent's licence.
Built to be checked, not trusted
The claims are on the record and the record is public where it can be.
"The button halts authority instantly and provably. The agent's own host refuses it, and no one can resume it on an unsigned word."
From the interchange paper, on the emergency stop.
Papers and benchmarks
The design is published and the measurements are public. Read them, cite them, run them.
A Licensing and Accountability Layer for Inter-Agent Protocols: "Have your agent call my agent"
Zenodo preprint, 10 Aug 2026, CC BY 4.0. Registries, licences bound to verified people, revocable permissions, and receipts both sides keep and anyone can recompute, modelled on a century of vehicle licensing.
xChk: Bring Your Own Identity: Heterogeneous Assurance with Verifier-Determined Sufficiency
arXiv cs.CR, cs.CY, 15 Jul 2026. Each service applies its own policy to the portfolio of proofs a person brings; covers human approval of high-risk actions by people and by agents.
Benchmark scorecard, October 2026
External suites (AgentDojo, spikee, AgentGovBench, DEMM-Bench) plus the control-plane benchmark: attacks on the gate in five harnesses, detection of actions that ran unrecorded, and what the gate costs honest work. Failures are published with their fixes.
Who it is for
Teams running coding agents
Know what your agents did, under whose authority, with a stop that works. One licence per machine, one grant sheet per agent.
Compliance and audit
Examiner-ready records: who authorized, who approved, what ran, sealed and anchored. Exports shaped for the rules that already exist.
Insurers and underwriters
Telematics for agents. Engagement of controls, continuously proven, so a safety feature can be priced instead of asserted.