The runtime your agent operates inside.
Most pitches for AI verification describe a tool the agent can call. That model fails the moment trust matters. Anything the agent can choose to skip will be skipped on the call that matters. Anything the developer can bypass will be bypassed under deadline pressure. Discretion is not a security model. Limma is the runtime the agent runs inside, with structural choke points it cannot route around.
Three structural touch points. None of them bypassable.
Every point where the agent touches data, calls a model, or commits an action is enforced by Limma at the infrastructure layer, below the agent’s code. The agent can be written naively. The framework can be any framework. The model can be any model. The wrap is structural.
The agent reads from the workspace, not raw data.
Every source enters Limma first. The agent does not read files from disk or rows from the warehouse; it queries the workspace and receives typed facts with citations and verification status attached. If a fact is not verified, the agent cannot see it as a verified fact.
Every model call routes through Limma.
The customer points their LLM base URL at Limma’s proxy. From that moment, every prompt the agent sends and every response it receives passes through the proxy. The proxy re-checks the model’s proposed output against the workspace before it returns.
Downstream consumers require a Limma contract.
Every consequential action produces a signed contract carrying the inputs, the workspace state, the verdict, and a cryptographic anchor. Filing systems, counterparty agents, internal queues, and regulators accept the action only against a valid contract. The gate is on the receiver, not the sender.
A real action. A real verdict. A real chain.
Five agents about to fire a consequential action, each cycling every few seconds. Each card is the verdict the engine returns when the agent posts its proposal: proceed, advisory, or refused, with the evidence chain attached.
What an agent gains when it runs inside Limma.
Capabilities that arrive when the agent operates on Limma rather than over raw retrieval and model memory.
Autonomous action in regulated work
Agents that file, transmit, sign, or transact do so with a verification chain attached. The audit story is mechanical, not narrative.
Honest uncertainty
The agent refuses precisely. Unknown stops being a hedge and becomes "missing input X, which would close goal Y." Refusal becomes acceptable to downstream consumers.
Compositional reliability
A ten-step derivation is not the chained probability of ten independent model calls. Each step is a rule applied against verified inputs. The chain stays sound at depth.
Disagreement detection across sources
If two sources the agent has read conflict, the engine flags the conflict and identifies the disputed value before the agent acts on either side.
Replayability
An auditor can reconstruct the workspace state at the moment of the decision, re-run the verification, and confirm the result. State versioning + deterministic verification.
Customer-specific reasoning
The firm’s playbook becomes a rule library. The agent inherits institutional knowledge automatically. This is the moat retrieval cannot deliver.
The wrap, in stages.
The engine, the MCP server, and the Python SDK ship today. The verify-proxy and action contracts are in active build; they are what turn an ergonomically wrapped agent into a structurally wrapped one.
- Verification engineWorkspace, ingest, typed fact store, rule library, four verification passes.
- MCP serverLimma’s verbs (verify, query_workspace, attest) exposed to Claude Desktop, Cursor, Zed, Continue, and any MCP-compatible client.
- Python SDKClient library wrapping the engine’s REST API for direct application embedding.
- Verify-proxyLLM-base-URL proxy that re-checks every model output against the workspace. The highest-leverage build target: the only deployment surface that closes the discretion problem structurally.
- Action contractsSigned certificate generator carrying inputs, workspace state, verdict, and a cryptographic anchor for downstream consumers to verify against.
- Task workspacesTransient child workspaces that inherit firm-overlay rules. Action contracts persist back to the parent workspace as durable audit artifacts.
Trust a structure, not a model.
Every other agent framework asks the user to trust the model. Limma asks the user to trust a structure. If you are building agents that take consequential action, this is the layer that makes them safe to ship.