CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED ·
When two faults look the same on the sensors, RiskGate widens its doubt instead of guessing, and lets an operator action through only if it is safe for every fault that still fits.
Transcript0:54 · narrated
Simulated plant (Tennessee Eastman · public data, Rieth et al. 2017) · consequences rule-derived · offline analysis
01 · What happened
The situation
The Tennessee Eastman chemical-plant benchmark. One simulated run, replayed with and without a fault: faults 3, 9 and 15 produce the same reactor-pressure trace as normal operation, while fault 6 is obvious within hours.
02 · The miss
Why the obvious safeguard didn’t catch it
A classifier still has to name one fault. Here its best guess is fault 4, which is wrong; on the hard faults the top guess is right only about a third of the time.
03 · RiskGate
List, play forward, decide
Obvious fault: one candidate on RiskGate's list. Can't tell: it keeps all five that still fit.
The assistant's move, raise reactor cooling water, is checked against all five: safe for every one, so it is certified.
Later a sixth fault fits that the move was never tested against: it asks the operator.
04 · At scale
What held, and the price
Across 81,900 two-hour windows from 2,100 held-out simulated runs, the true fault made the list 95 times in 100. Lists stay short (about 2 on average) and widen only when needed: about 1 for obvious faults, about 4.7 when the sensors can't tell.
95 / 100true fault on the list
~2candidates on average
1.0 vs 4.7obvious vs look-alike faults
Name one action your agent isn’t allowed to take today.
Send us its traces and what happened afterwards. We’ll show how often it could have run safely, and what it would have stopped.