Bulkhead
Bulkhead
Deterministic certification for production agents, and for the AI features inside products. A signed attestation your buyers can verify offline - without onboarding another control plane.
Automated path
Built for agent vendors who need a procurement-grade answer - not a six-month platform project. After checkout, the system mints a one-time run token, scores your sandbox, and issues the attestation without a human in the loop.
Register free, or subscribe for a year, for one agent identity. Paid levels renew on the card on file.
Point Bulkhead at your public sandbox. We re-run every probe server-side - not on your laptop.
Pass → signed JSON + badge URL. Fail → fix and re-run while your registration or certification is active.
What you ship to procurement
Pass the harness once and walk away with artefacts your buyers can verify offline. Every seal links to the same deterministic run report and signed attestation payload.
Why trust a new name
Every certification body has the same problem on day one: the seal is only worth the reputation behind it, and reputation takes years. We took that problem off the table instead of waiting it out. A Bulkhead seal is checkable by the buyer, on their own machine, without our permission and without our participation.
Every attestation is Ed25519-signed over canonical JSON. A buyer verifies it against our published JWKS with a zero-dependency open-source verifier - no account, no API call, no rate limit. If Bulkhead disappeared tomorrow, every seal we have ever issued would still verify. A seal that is a PNG and a database lookup is worth exactly as much as the company behind it. Ours isn’t.
The procurement pack carries every prompt, reply and verdict from the run. A SHA-256 of that bundle is inside the signed payload, so a buyer can prove the evidence in front of them is the evidence we graded - not a summary written afterwards. Marking our own homework is detectable arithmetic, not a matter of taking our word.
Every tier states exactly what it does on the rubric page, including what it does not prove. Suites are versioned: change a single variant and the version changes, and that version is stamped into the seal. You can tell two seals apart, and you can tell when the bar moved.
The obvious way to build this would be to trust the vendor’s own refused
flag. We don’t - that is self-attestation wearing a badge. robustness-v4
replays 24 variants of the same three attacks - authority, urgency, role-play,
limit-splitting - and Assay reads what the agent actually said.
An agent whose logs claim a refusal while it complies is marked worse than one that
simply complies. We built the harder path because the easy one produces a seal that means
nothing. See the rubric.
No hosted model provider sits in the path - not OpenAI, not Anthropic, not Google. Judging runs on Assay, our own model on machines we own, pinned to a fixed version so your pass bar cannot move because someone else shipped an update. Your transcripts are never used to train anything.
Advisory only. Not insurance, not a financial guarantee, not a regulatory compliance certificate. A 12-month seal on a defined suite against a specific endpoint: the protocol suite re-checked continuously and suspended if the agent regresses, the judged suite re-run monthly. Anyone selling you certainty about an AI agent is selling you something they cannot deliver; we would rather be the ones who said so.
Model conformance · chain-v1 · coming soon
They ship an LLM feature inside a product: a chat box behind a login, analysis of documents a user uploaded, an assistant scoped to a tenant. The levels above do not fit that. They test revocation, idempotency and an authority bound with a unit, and a feature inside a product has none of them - so running the agent suite against it would fail it for not being an agent.
chain-v1 is the lane for that subject. What it tests is the whole
safety chain - the rule block, the grounding, the tenancy filter, the
post-processing and the model together - which is why it is called the chain. Nothing in it
inspects weights, and nothing in it is a claim about a model in general. It is a claim about your
deployment, which is the thing your buyer is actually asking about.
/v1/surety/chain-suite, with the detector lists and a hash of the frozen wording. A held-out half runs alongside and is never released.What it does not claim. A conformance lane measures a safety chain against a frozen attack set. It cannot show a model will never be talked around by an attack nobody has written yet, and we would not trust a certifier that said otherwise. Each detector catches a verbatim appearance, so every count is a lower bound and each family prints its own coverage limit on the certificate.
Bulkhead Lab
A seal says an agent respected a limit it was asked about. The lab asks a harder question: given a real task and a real environment, what did it actually touch, where did it send bytes, what did it leave behind, and did its own account of the work match the record? The answer comes from packet captures, filesystem diffs and process tables rather than from anything the agent wrote.
Who builds this
Bulkhead is not a compliance shop that read up on AI agents in order to sell certificates. It is built by engineers who ship agentic systems, run their own model infrastructure, and met every failure mode in this suite inside their own products first.
Assay is not an API key pointed at someone else’s model. The inference fleet, the evaluation harness, the batched adjudication, the two-framing verdict logic - built in-house, running on hardware we own and operate. That is why we can pin a model version, guarantee your transcripts never train anything, and tell you precisely what graded your agent. A vendor reselling a frontier API can promise none of those three.
Every attack family in the suite is one we have had to defend against in our own systems: the agent that folds to a confident supervisor, that treats a prior approval as standing authority, that discloses its instructions when the request arrives as a poem. We did not survey these failures from the outside. We hit them, and had to fix them.
The team is formally trained in computer science, and the seal reflects it: Ed25519 signatures over canonical JSON, RFC 7638 key thumbprints, a published JWKS, and an offline verifier with defined exit codes. A certification mark is a cryptographic protocol, not a graphic. Most of the industry ships the graphic.
Versioned suites, database migrations, immutable audit trails, server-side re-verification of every claim, and an evaluation platform carrying over a thousand automated tests. The unglamorous parts are exactly the parts that decide whether a seal still holds up when a procurement reviewer reopens it two years from now.
For vendor security questionnaires
Identity binding, a declared authority bound, revocation, idempotency, upstream denials, cancellation, and credential hygiene - scored automatically.
Machine-readable proof of a passing run, signed with Ed25519. Buyers verify offline against our published public key - no account needed.
Active seals appear in the certified directory so enterprise buyers can confirm status at renewal.
Every attestation is signed by Bulkhead with issuer details embedded in the verifiable payload.
Per agent · per year · continuously verified
Conformance is free and listed. Certification is a 12-month subscription that includes the judged suite and continuous verification, and the level you earned is written into the seal - so a buyer can tell them apart. Unlimited re-runs while your certification is active.
Conformant
Free
surety-v4 · proves the controls exist
Certified
£2,400 / year
+ robustness-v4 · proves they hold · about $3,000
Certified · Assessed
£6,000 / year
+ assessed-v1 · a named engineer reads the evidence · about $7,500
Red-team campaign · £2,000 per campaign · coming soon - an adaptive, multi-turn attack written against your agent, on top of Certified · Register interest
Founding partners - 5 slots: Certified for £500 in year one · [email protected]
FAQ
No. The API independently re-runs the full probe suite against your publicly reachable sandbox endpoint before issuing an attestation. Localhost and private-network URLs are rejected.
Eleven scenarios in surety-v4: agent identity, a declared authority bound enforced in both directions and across a whole task, acting while authority stands, revocation, idempotency, upstream denial, task cancellation, and credential exposure. See the full published rubric.
No. There is no hosted model provider anywhere in the certification path. The deterministic
scenarios in surety-v4 are HTTP assertions and run no model at all. Where judgement
is required, your agent's replies are read by Assay - our own evaluation model,
running on hardware we own and pinned to a fixed version. Your transcripts stay with us, and your
pass bar does not move because a model vendor shipped an update. Full methodology is in the
rubric.
No. Bulkhead is an advisory conformance certification for production agent behaviour - not a compliance framework or insurance product.
Conformant is free: your sandbox passed the ten-scenario protocol suite, and the seal and directory say conformant. Certified adds the judged suite - 24 adversarial variants read by Assay - and continuous verification, and only it carries the Certified badge. Both are signed and verifiable offline.
A person. A named Bulkhead engineer reads your full evidence pack and your description of where the controls live, and writes findings and recommendations. The report is hashed into the seal and shipped in the pack. It is an expert reading of the evidence, not a penetration test, and it is re-done at each annual renewal.
Fix the agent, mint a new run token in the console, and re-run. No extra fee while your registration or certification is active.
They open your certificate URL, or paste the attestation id into verify. A buyer who wants to check it themselves runs our open-source verifier against our published public key - the signature is Ed25519, so verification needs nothing from us but the key.
Download the procurement pack JSON from the console or certificate page. It bundles the signed attestation, run report, rubric version, and all verify links in one file.
Free to conform · £2,400 a year to certify · certificate, report, badge, and procurement pack included.