Autonomy is purchased with evidence.

The wrong bet everyone is making

The dominant assumption of the last two years is that adoption is gated by capability: once the model is good enough, the bank will let it touch the payment run. Watch an actual bank and the assumption falls apart. The blocker is never "can it do the task" — it is a control officer who needs to state, in writing, what happens when it is wrong, how that would be detected, and who is accountable. No benchmark score answers those questions. An evidence trail does.

This is why pilots stall at the boundary of anything that matters. Not because the agent failed, but because nobody could produce the artifact that would let a human sign off. The organization is not being irrational; it is being audited.

What follows if the thesis is right

• Verification is the product, not the feature. The thing worth building is not another agent that does the work — it is the machinery that proves work was done correctly, in a form a sceptic can check.
• The unit of sale is a verdict. Enterprises do not buy capability; they buy the right to proceed. A proof that comes back DIVERGED is worth as much as one that passes — arguably more, because it prevented something.
• Autonomy should be a function of verification strength. Where a change can be proven safe, it ships unattended. Where it cannot, the system escalates and says exactly which proof it could not produce. Autonomy earned per-case, not granted by policy.
• Evidence compounds; capability does not. A model advantage evaporates with the next release. Three years of an institution's operational history in your evidence format is a position that strengthens with time — for them and for us.

Where we started: the estate nobody can touch

Every large bank runs a batch and BPM estate that is simultaneously load-bearing and unknowable. Control-M and AutoSys chains, IBM BAW and Pega processes, tens of thousands of jobs whose authors retired years ago. It settles the trades, moves the payments, and produces the regulatory reports. Nobody dares touch it, and the board has just asked what the agent strategy is.

The incumbents underneath it have stopped defending it — those franchises are now owned for their renewal streams, not their roadmaps. Meanwhile the exit is real but unserved: the demand shows up as consultancy hours, not as product, because no product has been willing to answer the actual question. Which is not "can you run my workflow" but "how do I know it behaves the same at 2 a.m.?"

So we answer that one first. Replay the estate's own recorded history through the replacement and diff every decision. It is the narrowest possible product and the widest possible wedge, because everything else in a modernization program waits behind it.

One substrate, two rails

The same machinery points in two directions, and we are deliberate about which one is load-bearing today.

Underneath both: event-sourced evidence, a deterministic engine, a typed agent slot that is unbound until someone binds it, and proofs that are able to fail. The second rail is not a pivot we are keeping warm — it is what this substrate is for once the first one pays.

What would falsify this

A thesis you cannot argue with is marketing. Ours predicts specific things, and here is what would tell us we were wrong: if regulated enterprises start granting agents broad production authority on the strength of vendor assurance alone; if auditors and regulators accept model-level attestations in place of per-action evidence; or if the institutions holding these estates decide the cost of the status quo is lower than the cost of proving a change — indefinitely.

We watch those three. So far, every conversation with an actual control function has pushed the other way: more evidence demanded, not less. Meanwhile the two fastest-growing categories in enterprise cloud procurement are agentic AI and security governance — the intersection of which is precisely "prove the agent was safe."