Scoped.Dated.Revocable.Fail-closed.
AI² licenses hardware-enforced authorization to the companies that ship silicon, safety systems, and infrastructure.
The license is built the way the hardware is built. Authority not written on the ticket does not exist.
Specimen. Every grant issues on this one page, bound to a hash of the terms it was issued under.
A layer, not a product.
Agents propose actions. Something has to decide whether those actions reach a payment rail, a setpoint, or a provisioning interface — and that decision cannot live inside the thing being governed.
AI² builds that decision as a hardware boundary. The agent proposes a typed action. The gateway checks the attested measurement, evaluates explicit policy, and if permitted mints a short-lived credential bound to the exact canonical payload. The target executes only if the hash, signature, identifiers, window, and consumption checks all pass.
We do not intend to build the parts. We license the architecture, the reference implementation, the conformance suite, and the know-how to the people who already ship them.
Three schedules, one form.
Mix and match on a single ticket. State shown is the current issuing state, reported the way the Gate reports its own.
Charter
Evaluation, architecture review, and design-in study by a named charter participant. Not production use.
- Architecture specification
- Reference implementation and verifier
- Conformance suite
- Engineering support hours
- Twelve months, non-renewing
Runtime
Production deployment of the software and firmware embodiment on enumerated protected paths.
- Runtime distribution
- Signed policy-loader tooling
- Updates during term
- Fees per protected path
- Conformance pass before production
Hardware
Right to manufacture units embodying the architecture, for incorporation into your products.
- Hardware description and reference design
- Qualification procedure
- Fixed fee per unit shipped
- Isolation boundary is contractual
- Issues after the October 2026 red team campaign closes
The instrument enforces what the hardware enforces.
Five terms make this a grant rather than a subscription. They are not negotiable decoration; they are the consideration.
The ticket is the authority
Scope, term, paths, action classes, and named persons live on one signed page bound to a hash of the terms. Amend the terms and the old ticket does not move. Unsigned, it authorizes nothing.
Bypass suspends the grant
Route around the gate, run it in advisory mode, or default to anything but deny on fault, and the grant suspends at the moment it happens. Remediation does not restore it. Paying the invoice does not restore it.
We audit denials, not usage
The audit does not ask whether you ran the software. It compares payloads the gate denied against payloads your actuators executed. A match is the only thing being looked for.
Loosening requires ceremony
Tightening the invariant set is always available, immediately and unilaterally. Loosening it takes two signatures from separate roles, a timestamp, and a record. A quiet admin edit is a bypass on its own.
The theory has a kill condition
We assert that a material share of agentic incidents are out-of-grant actions reaching an actuator, not model incapacity. After twelve months, an independent reviewer classifies your own incident records against that claim. If the number comes back below the threshold, you wind down Schedule B or C prospectively, without penalty. A claim worth licensing is a claim worth testing.
Published, not negotiated.
Non-exclusive, always
We license your competitors. That is stated in the instrument and it is not variable by side letter. Exclusivity is not on the table in year one.
A rate card, not a negotiation
Rates are published. Volume tiers are the only variance. No most-favored-nation terms, in either direction.
Per path, per action class, per unit
Never per seat. Hardware royalties are a fixed amount per unit shipped, not a percentage of anything.
Metered by the gate itself
Usage reports are signed counter readings from the hardware root of trust. No telemetry, no phoning home, no trusting the accounting.
An up-front that pays for engineering
Integration support is priced separately from the grant fee, so the work that gets you shipping is scoped work rather than a favour.
Termination does not brick anything
Gates already deployed keep enforcing. Removing an enforcing gate is the unsafe act, and no term of ours requires it.
What we do not claim.
Every grant carries a schedule that forbids licensees from saying these things in our name. It would be strange to enforce that outward and not state it here.
- It does not make an AI system safe, aligned, or trustworthy.
- It does not read, infer, or constrain what a model intends.
- It does not judge whether a goal is a good one.
- It does not detect goal drift.
- It does not make your invariant set complete. You write those rules; we enforce them exactly as written.
- It does not decide who inside your organization should hold authority.
- It does not satisfy any regulation, standard, or insurance requirement on its own.
- It is not a guardrail, a policy filter, an alignment layer, or a moderation service. Those run in the host domain. This does not.
The guarantee holds only on paths that terminate in the authorization check. Intellectual property: patent pending, provisionals on file. Provisional applications confer no enforceable exclusionary right, and we make no representation that any will issue or as to the scope of any claim that may. Nothing here should be read as stating that an issued patent exists where one does not.
Counterparties who already ship the part.
Root-of-trust and secure-element vendors
You have the channel, the fab relationship, and an attestation story. This is the adjacent claim.
Functional-safety and industrial control
You already sell certified fail-closed interlocks. Agents are a new class of proposer against the same doctrine.
Server ODMs and confidential-computing platforms
A differentiator the hyperscalers' internal stacks do not currently carry.
Underwriters and risk carriers
Not licensees. The parties who decide whether an enforced boundary is worth a premium credit.
Start with a Charter grant.
Tell us the actuator you need governed and the path that reaches it. If it is a fit, we send Schedule 0 and Schedule A. If it is not, we will say so in the first reply.
Request a Charter grant