MIO° Conduct Record™
A sealed record of what your AI agents are allowed to do.
MIO° Conduct Record is a sealed register of what an organisation's AI agents are authorised to do, and which agents exist. When something goes wrong, or an auditor asks, you can show what each agent was authorised to do at the time. Where its mandate check is turned on, Village Gateway denies a request that falls outside the mandate in force.
What it does
- A change to a mandate is a new dated record that supersedes the old one, and the old record is kept.
- A lookup of the mandate in force at any given time is available through the API on both production servers, in New Zealand and the EU.
- An auditor can check a Conduct Record offline, without an MDSL account.
- One reading experiment of our own, in which AI models read 25 invented records against one mandate, recognised out-of-mandate acts at a rate of 100% for blatant acts, 92% for moderate acts and 58% for subtle acts, and it flagged none of the 36 clean cases. It measures a reviewer reading the record, not something the register does. The 58% means occasional sampling would miss most isolated subtle acts.
What it is, and what it is not
The lookup shows what was recorded, as recorded. Each answer to a lookup of the mandate in force carries a warning: the order in which mandates were recorded is not yet tamper-evident. Someone could change that order without leaving any sign of the change. Someone with write access to a Village's records could therefore backdate when a mandate was recorded. MDSL holds the key that signs a record. For a Village moved onto the separate signing host that MDSL operates, the key sits outside the process that writes records; your Order Schedule states which applies. Two checks of an action against its mandate are built. Each one stays off until the operator turns it on. Village Gateway checks any request it governs, where a policy requires a mandate: the action, the resource, the amount and the time window must fall within the mandate in force for the agent, or the request is denied and the reason is recorded on its signed receipt. When an AI agent proposes to send an email through the Email Decision Record, the action name is compared exactly with the actions the mandate in force permits, and a name not on the list is refused before any email is held; that check compares the action name only (never the content, the recipient or an amount). The register itself records authority and does not block anything. Continuous monitoring of agents is not offered.
Daily anchoring on Midnight mainnet
Status: Built. Where an account has it turned on, the Conduct Record records we have sealed join our signed daily estate root; the anchoring contract on Midnight mainnet, a shared ledger, is built to take that root’s hash for the date. No mainnet anchor has been made yet. Only hashes go on the ledger. No record, name or agent detail does.
An anchor shows that a value was recorded under a date key. It does not answer whether the records are true or complete. It is an attestation by our service key. Midnight is a federated network, not a decentralised one.
How a record reads never depends on Midnight. The signature and the outside time-stamp token decide that, and the offline checker, governance-receipt-verifier.js, gives the same result with or without an anchor. When an anchor proof and the ledger reading are supplied through the options --anchor-proof and --anchor-check, the checker reports anchored or anchor_not_checked on a separate line.
Coverage: records held on our OVH servers only. A record that is signed and sealed after a day's range has closed joins the next day's range. The date an anchor carries is therefore the date of the daily root that first took the record in. It can differ from the day the record was created.
Price
| Sealed Statement | — per Sealed Statement |
|---|---|
| Standing Record pilot, per agent | — /month per agent |
A Standing Record pilot covers up to five agents with a 90-day term. No GST is added.
How to get it
Conduct Record is available on request. There is no self-service signup, no trial and no free tier. Tell us a little about your agents and what you need to be able to show; this creates no account, and every request is reviewed before anything is issued.
Related
- Governance API: the interface your software calls before an AI agent acts (sandbox by invitation).
- AI Visibility Auditor: measure what AI assistants say about you, and keep the measurement as a sealed record.
- Attested Accounts: finance records that show whether they were changed.
- The Village catalogue and price list · Pricing
Status as at 27 October 2026.