Agents don’t crash. They commit.

Software fails loudly. A null pointer, a stack trace, a 500. The system stops and something is obviously broken.

Agents don’t fail like that. An agent hits an obstacle, decides how to get around it, and keeps going. The action it takes is authorized. The arguments are well formed. The call succeeds. Nothing in your stack has any reason to object, because from the outside it looks exactly like the system working.

You find out from a support ticket.

This is not a security problem. Nobody attacked anything. There was no injection, no exploit, no stolen credential. The agent had real access and used it correctly. Hand the same trace to a security team and they find nothing, because nothing was breached.

This is not a permissions problem. The agent was allowed to issue that refund. It was allowed to send that email, cancel that booking, write that record. Every permission system asks whether the caller may perform the action. The answer was yes. The answer was supposed to be yes. Tighten the permissions and you break the agent without fixing anything.

This is a correctness problem, and it happens at execution time. Not in the prompt, where the words were fine. Not in the eval suite, which ran last week against cases that weren’t this one. Not in the trace, which is complete, accurate, and written after the money moved. It happens in the instant between an agent proposing an action and your backend performing it, and until now nothing has been standing there.

Monitoring is mourning. The dashboard is the obituary. Salus is the intervention.

So we ask a different question. Not whether the agent may act, but whether the action is real. Whether the amount came from the lookup. Whether the recipient came from the order. Whether the confirmation was for this action and not a different one. Whether the price was checked this morning or three turns ago.

That check runs in the execution path, on every consequential action, before the call goes out. Structural checks resolve deterministically; optional reasoning gates can add stricter signals when structure cannot settle a case. Every decision reports which path produced it. It returns a reason, not a refusal, because a system that only says no gets removed in a week.

We want agents worthy of the trust you place in them. Not agents that ask permission. Agents that can prove what they’re about to do.