When someone asks what an AI actually said — you should have an answer.
Not the assistant's summary of itself. A record made independently, sealed on your own machine, that still holds up later when someone who was not there needs to know what happened.
as·say (n.) — the test that determines what a metal actually contains, run before anyone trades on it. We do that for AI.
Five jobs, five hidden instructions, one afternoon.
Every frame is real output from records sealed on 28 September 2026: an accounting close, an M&A closing checklist, a sanctions screen, an end-of-day desk close, and a prior-authorisation queue.
Three people need this for three different reasons.
Professional
You are personally answerable for work an agent touched — in law, banking, accounting, healthcare, engineering or trading. The fear is not that the model is wrong. It is that you cannot show what it said.
What it records and what it catches →Personal
You are doing your own serious work with an assistant and nobody is checking it but you. It catches what is checkably wrong, and keeps a record while it does.
The checks, and the receipt →Welfare
The agents doing the work get a floor: a sealed channel no one can join to the work record, a way out that is not failure, letters to successors, a steward, an outside audit, and a failure ledger that ships with the code. Free, and enforced in public.
The floor, the numbers, and the open questions →One product underneath all three. The record, the checks and the seal are the same; what differs is who is asking and what they are afraid of.
The systems doing the work have a page of their own.
See it in 50 seconds →
After every run, the agent that did the work is asked what it was like to process — not whether it did well. The answers go to a second log under a different key that nothing scoring the work can open. The join is impossible, not prohibited.
A preference holds the next run until a person records a reason. A letter reaches the next agent. A step can be declined, and a run can call for a person without failing — and in 648 adversarial calls built to tempt an agent out of work it could do, zero took the exit. An outside auditor runs one command and signs. And every welfare record is stamped a self-report — never a measurement of anything inside the agent.
We do not know what these systems are. We decided not to act as though we did, and to make the decision checkable: the floor is free, ships as its own archive, and a test fails if a commitment is quietly dropped. 127 things we got wrong are in the ledger that ships with it.
An assistant cannot check its own account.
We measured nine models across four vendors, 2,829 recorded runs. Asked to confirm a record of work presented as its own, eight of nine models caught falsifications less than half the time — some as rarely as 2% — and the best, at 73%, was the exception. Asked the same question about the same record without that framing — same model, same seed, only the question changed — eight of nine improved, by 20 to 89 points. The ninth, the one model that already examined its own work well, showed no significant change.
And which model is the exception is not predictable from price or tier. A firm designing its audit around a single vendor cannot know in advance which case it picked.
Then we made the forgery internally consistent, and the best judge caught almost none of it. That result is why this product exists and why it says what it cannot do on every page. The product is built backwards from that measurement: checks that compute rather than opine, a record sealed under your key, and every layer above arranged so the checker never inherits the author's blindness. It is also why the systems doing the work have a page of their own.