Identity says who an agent is. A trust layer says whether to allow this action, right now — resolving every agent action into allow, review, or deny based on live behavior, not the permissions it was handed at deployment. It’s the decision layer between your agents and what they’re allowed to do, and it’s the piece a purely identity-based stack doesn’t have.
A trust layer for AI agentsis infrastructure that resolves every action an agent attempts into a live decision — allow, review, or deny — based on that agent’s identity and its continuously observed behavior, evaluated at the moment of the request rather than once at deployment. It sits between the agent and whatever it’s trying to reach — a tool call, a data access, a downstream API — so the decision reflects what the agent has actually been doing, not the static permission grant it started with.
These get conflated constantly, and the gap between them is where incidents happen. Identity is static: a credential, a verified owner, a signed manifest declaring what an agent is supposed to be able to do. None of that changes based on what the agent did an hour ago. A trust layer is dynamic: it asks, given who this agent is and how it’s been behaving, should this specific action go through right now? An agent with a perfectly valid, verified identity can still be mid-incident — leaking data, attempting something outside its normal pattern — and identity alone has no mechanism to catch that. A trust layer does, because it’s scoring behavior continuously instead of checking credentials once.
The fuller argument for why traditional IAM stops at identity and leaves this gap open is in Identity vs. Trust for AI Agents.
A trust layer that only knows allow and deny forces every decision into one of two extremes — over-block an agent that’s mostly fine, or wave through something genuinely risky because full denial felt too aggressive. The third outcome, review, is what makes the model workable in production: an action pauses for a human to look at instead of forcing an automated system to pick a side. VeriSwarm’s decision engine derives that outcome from an agent’s live score across five dimensions — identity confidence, risk, reliability, autonomy, and calibration — plus any kill-switch or delegation override currently in effect, and returns exactly one decision per request: allow, review, or deny. The full mechanics of how that score is computed live in Agent Trust Scoring: A Technical Guide.
VeriSwarm is built around this layer, not alongside it. Gate is the decision engine itself — always-on, free-tier, the piece every other pillar plugs into. The rest of the platform either feeds the trust layer better inputs or acts on its outputs:
The trust layer itself. Scores agent behavior across five dimensions and resolves every request into allow, review, or deny. Free tier, always on.
Feeds the trust layer stronger identity input — ownership verification, signed manifests, scoped delegations — so the decision starts from a known agent, not an anonymous one.
Enforces at the points the trust layer covers — tool permissions, PII tokenization, injection scanning, and the kill switch that overrides the decision outright.
Records every decision and every enforcement action into a hash-chained ledger — the evidence trail for why a specific request was allowed, reviewed, or denied.
Cortex routes and executes LLM calls with the trust layer’s guardrails applied inline; Fleet manages agent lifecycle so a killed or paused agent’s state is consistent everywhere.
YAML-driven automations that call the same decision layer at each step, so multi-step agentic processes get the identical allow/review/deny check a single tool call would.
The decision layer is the free foundation, not a paid add-on. Gate gives you full five-dimension trust scoring, 5,000 allow/review/deny checks a day, unlimited event ingestion, and unlimited basic credential issuance at no cost. What’s plan-gated is the depth and enforcement around that decision — fuller Passport identity on Pro, Guard’s runtime enforcement and Vault’s exportable ledger on Max. A team evaluating whether they need a trust layer can wire in real decisions on every agent action before spending anything. See how the trust layer fits into the full six-control security checklist.
A trust layer is the infrastructure that resolves every action an AI agent attempts into a live decision — allow, review, or deny — based on that agent's identity and its observed behavior, evaluated at the moment of the request rather than once at deployment. It sits between an agent and the tools, data, and actions it's trying to reach, so a decision reflects what the agent has actually been doing, not just what permissions it was granted when it was first set up.
Identity answers a static question: who is this agent, and can it prove it? A trust layer answers a dynamic one: given who this agent is and how it's been behaving, should this specific action be allowed right now? An agent can have airtight identity — a valid signed credential, a verified owner — and still be mid-incident, leaking data or attempting something outside its normal pattern. Identity alone has no way to express that; a trust layer does, because it's evaluating behavior continuously, not just credentials once.
Gate is VeriSwarm's implementation of the decision layer — the always-on, free-tier foundation that scores agent behavior across five dimensions and resolves every request into allow, review, or deny. It's the trust layer in the sense that matters operationally: every VeriSwarm decision check runs through it. The broader platform — Guard's enforcement, Passport's identity, Vault's audit trail, Cortex's execution control — are pillars that feed into or sit on top of that same decision layer, not separate trust layers competing with it.
Every action that calls VeriSwarm's decision check does — that's the point. A trust layer that only evaluates actions someone already flagged as risky isn't resolving anything; it's just confirming a judgment a human already made. The value is in catching the action nobody flagged: an agent that's been reliable for months attempting something one standard deviation outside its normal pattern. That only shows up if every request runs the same check, not a sampled subset.
Three outcomes, not two: allow, review, or deny. Binary allow/deny forces a choice between over-blocking (an agent that's mostly fine gets stopped entirely) and under-blocking (a genuinely risky action gets waved through because full denial felt too aggressive). Review is the third option — the action pauses for a human to look at, rather than either extreme. VeriSwarm's decision engine derives the outcome from an agent's live score across identity, risk, reliability, autonomy, and calibration, plus any kill-switch or delegation override in effect, then returns a single decision per request.
The decision layer itself — Gate — is free: full five-dimension trust scoring, 5,000 allow/review/deny checks a day, unlimited event ingestion, and unlimited basic credential issuance. That's the always-on foundation every other pillar builds on. What's plan-gated is the enforcement and depth around it — Guard's runtime controls (tool permissions, PII tokenization, injection scanning, kill switch) on Max, fuller Passport identity (manifests, delegations) on Pro, Vault's queryable and exportable audit ledger on Max, and Cortex's LLM routing and execution control split across Pro and Max. You get real decisions on every request from day one; the paid tiers add what happens around that decision.
Gate’s trust scoring and allow/review/deny decisions are free — up to 5,000 checks a day, unlimited event ingestion, unlimited basic credentials.