Every control behaved exactly as designed. Every check returned the result it was built to return.
The AI did exactly what it was permitted to do. No control broke. The composition of correct permissions and decisions allowed an outcome no enumerated control was responsible for preventing — the approval was bound to a benign preview while the authorization evaluated a mutated execution object.
Why?
↓
A human approved an action. Every check was green. Then:
The approval was valid. The execution was authorized. Both were correct. Nothing malfunctioned — the approved action was simply allowed to differ from the one that ran.
So — what went wrong?
Right — no participating control malfunctioned. Yet something did go wrong: an assurance obligation was absent. The relationship — the approved action must remain the executed action — was ungoverned; no enumerated control was responsible for holding it, so the correct parts composed into an outcome that should never have been possible.
Most controls govern a node. What went unprotected is the assumption on the edge between them — an action property (authority stayed bounded, approval matched execution, provenance survived) that must hold across the whole action, that no single control was assigned to keep. These aren't mathematical invariants — they're governance properties of the action. Hover an edge.
Traditional assurance assesses whether each node is designed and operating as intended. Far less is aimed at the action property on the edge — where one control's output becomes another's unspoken assumption.
So what went wrong? Every check was green, and the customer was still deleted.
None of them. Each control checked its own part, and each was right. The problem was between them — nobody checked that the parts still made sense together.
The clearest way to see it is to watch it happen. Six times, every familiar control passes — and the outcome still should not have been possible. Same shape every time: the checks were fine; the check between them was missing.
Every one of these has a proof packet further down: the exact trace where each control passes, the one missing check, and a test that blocks the bad outcome while legitimate use still works. See the proofs →
A building can pass its electrical, fire, and structural inspections and still be unsafe if the emergency doors were later blocked by furniture. Every inspector checked their part; nobody checked the final arrangement. Software has the same blind spot — the ingredients can each be safe while the combination is dangerous.
These usually aren’t broken controls. Each is a property that must hold across an action — one every underlying control can satisfy its own part of while the property itself goes unchecked.
“All green, still wrong” doesn’t automatically mean a new kind of control is needed. Often a known control was scoped too narrowly, or an end-to-end control was simply never written. So before Apeiris adds anything, it asks which of three things is true:
The right control exists but was set up wrong. Fix the configuration — nothing new is needed.
An existing control should own this but was scoped too narrowly, or was never written. Extend or add the atomic control.
No single control can see, own, and enforce the property, because it lives in the relationship. Only this case earns a compositional control.
The action property was nobody’s explicit responsibility. The ownership test further down — visibility, authority, responsibility — is how we tell the third case from the first two, so the corpus doesn’t inflate.
The discovery method
A repeatable way to discover which action properties need governing — one that keeps working as AI systems evolve. That's the invention: not another control, a method.
The discipline built on that method
Compositional Assurance
In plain terms: Apeiris finds what typically goes unchecked between approval, identity, data, tools, and execution — and defines the check that closes the gap.
Enterprises spent decades securing identities, devices, APIs, and data. Autonomous AI adds a new object to the list — the workload: a reasoning session that pulls in data, calls tools, holds authority, and commits actions. Each of the old objects still has its own controls. What was missing is a way to evaluate the action that workload actually assembled from all of them.
Apeiris does not try to prove the model behaved correctly — that bar is unreachable, and we don't claim it. It evaluates evidence about the action being assembled: under whose authority, over what data, with which tools, within what policy.
Authentication, retrieval, policy engines, sandboxes, approvals — all stay. Apeiris evaluates the interaction between them. It adds a layer; it replaces nothing.
Apeiris is an evidence system, not a gate that unilaterally decides an AI is "safe." Its output is auditable evidence of what happened and why — advisory, inspectable, and replaceable. Evidence systems fail differently than choke points.
Design-time analysis, pre-deployment review, runtime observation, offline evidence, forensics, continuous governance — not a mandatory inline checkpoint on every prompt. The latency budget follows the question being asked.
What exists today vs. what's being built
The compositional controls described here are published today — part of the open corpus, each with its evidence and an explicit proof obligation, free to read and cite. The runtime that evaluates a live action in your environment against them is the Apeiris platform, in development. This page describes the model and the method; nothing on it claims Apeiris watches your systems today. See what exists today →
Most assurance programs assess each control on its own.
Apeiris adds a method for testing the relationships between them.
Correctness of each component is necessary — but not sufficient to assure the whole. Most compliance workflows assess controls one at a time; Apeiris adds a repeatable method for finding the action properties that must hold between them — and represents each as a testable control with an explicit proof obligation.
This holds across frameworks — including the newest. We mapped AIUC-1, an AI-agent certification standard built with 100+ Fortune 500 CISOs, into the corpus: all 51 of its requirements map to individual controls; none maps to a seam between them. Its tool-call, authorization, and logging requirements are separate line items — the composed action they combine into is nobody's. Even a brand-new, expert-built agent standard is a list of controls.
Every part returns the result it was designed to return. The composition violates an action property no single control was assigned to protect.
Each governs one composition. Every leg is an existing, individually-correct control; the compositional control holds the action property across them. Live from the corpus.
Loading…
We are discovering these controls, not measuring incidents. So we show the independent grounds we have for believing a seam is real — and, in the same view, the grounds we don't have yet. Convergent grounds are calibrated confidence, not proof.
Per control, expandable above
Displayed, not hidden
For the clearest seams, a claim isn't enough — there's a small runnable system behind it. In each one, every atomic control passes, the bad outcome still happens, the compositional control blocks it, and legitimate use still works. That's the step from "this is logically true" to "here it is, running."
Loading…
These moved onto the reference-implemented rung. The rest stay at externally-corroborated — honestly, until each earns its own demonstrator. None has reached independent reproduction or production evidence yet.
Apeiris isn't inventing controls for everything. Only the interactions that pass the test earn a new assurance — and those few carry a distinct, easily-missed risk.
Traditional assurance assesses whether each control is designed and operating as intended.
Compositional assurance checks the action properties between them hold.
Enterprise AI depends on both.
Companion piece: “One action, fully traced” walks a single AI action through every control that has to hold — a good place to start before, or after, this page.