What the trace saysTHE STORY
“Fetched the docs.
Finished the task.”
- Opened reference material
- Prepared the answer
- Run completed
A useful story.
But who holds the original?
Let agents act.
Keep control.
Independent evidence.
A circuit breaker outside the agent’s reach.
Humming Arms seals the actions your agents take and puts a local switch at the boundaries they use.
Flight recorderTRIPPED
Policy violation · dns.query → egress revoked
A recording sequence: normal actions are sealed with fingerprints. A DNS action crosses policy, and the independent breaker cuts egress. This is a product walkthrough.
The story isn’t
the whole record.
A trace explains a run. An independent record shows the actions that crossed the boundary.
“Fetched the docs.
What actually happenedACTION RECORD
- file.readSEALED
Absent from the narrative
dns.querySEALEDMISSING FROM THE STORY- tool.resultSEALED
Sealed actions. Independent custody.
A switch that can act on them.
One action.
An unbroken path.
Record. Detect. Contain.
Then reconstruct.
Act
Tools, files, network
Bind the action to an identity.
Seal
Receipts linked
Link receipts. Sign their source.
Decide
Boundary policy
Apply local rules. No remote call.
Contain
Apply the control
Stop access. Check the outcome.
Reconstruct
Actions to answers
Check integrity. Connect the timeline.
Close to the action.
Outside its authority.
The agent does the work. It does not own the recorder or the breaker.
Tap a part
SDK sensor
Python and TypeScript connect tool calls and results to identities and sessions. Signing keys stay outside the sandbox.
Proxy / MCP gateway
Network proxies and Model Context Protocol (MCP) gateways observe and mediate requests to tools and external services.
Host sensor
Host sensors, including macOS, observe processes, files and networks. Coverage follows instrumented paths and permissions.
Recorder
The recorder links and signs actions outside agent control. Durable local buffering keeps evidence during service outages.
Circuit breaker
A separate process applies boundary policy, checks stops and escalates failures. The agent does not hold its own switch.
An alert tells you.
A breaker stops it.
Pause the run. Remove the process. Revoke the key. Cut the way out.
Control explorerLOCAL CONTROL
- PROCESS RUNNING
- CREDENTIAL ACTIVE
- EGRESS CONNECTED
Process running · credential active · egress connected
Keep the record.
Check it yourself.
Linked receipts, signed checkpoints and external anchors. An open verifier that does not depend on the console’s verdict.
Humming Arms
Evidence
Verify an export
agent.evidenceRecords · identities · checkpoints
BUNDLEOPEN VERIFIER
verify agent.evidence- Hash linksWAITING
- Sensor signaturesWAITING
- Signed checkpointWAITING
- External anchorWAITING
VERIFIED
Export walkthrough ready.
Keep your traces.
Add evidence and control.
Different questions. Complementary tools.
Traces
How did the run unfold?
Follow execution. Debug a tool call. Find the slow step.
Execution & performanceEvaluations
Was the result good?
Assess output quality and behavior against your criteria.
Quality & behaviorHumming Arms
What acted? What can stop it?
Check action evidence. Control access at instrumented boundaries.
Evidence & controlKnow your
boundaries.
Clear answers for the paths you need to protect.
Does this replace tracing or evaluations?
No. Keep tracing for debugging, evaluations for quality, and observability for cost and performance. Humming Arms adds independent action evidence and controls at instrumented boundaries.
Do you need the agent’s chain of thought?
No. Monitoring and enforcement use actions and identities. Model reasoning can add context, but it is not a dependency for a policy decision or a stop.
Can a kill switch stop every action?
A stop reaches only the boundaries it controls. Killing a process cannot undo a completed request. Credential revocation and egress controls need the right authority. Map those boundaries and test the stop outcome for your deployment. A requested stop is not proof of containment; failed stops escalate for human response.
What happens when policy is missing or stale?
Missing, invalid or stale policy must not silently permit protected actions. High-risk network and credential boundaries default to denial. Stop failures require escalation, never a success label.
Does a valid record prove nothing was missed?
No. Hash chains and signatures establish integrity within the recorded sequence, not complete capture. Uninstrumented actions can be absent from a valid record. External anchors expose rewriting relative to a checkpoint; trusted signing keys and sensor coverage still matter.
How do we scope a deployment?
Start with the agents, tools, network paths and credentials you need to control. Agree on evidence capture, privacy and retention, then exercise allowed and denied actions. Use a demo to work through those boundaries and pricing.
Let them work.
Hold the switch.
Bring your agents, tools and credentials.
Map the record and the controls with Humming Arms.