Enforcing Policy with a Circuit
QuantumGuard Compiles an Agent's Policy into a Zero-Knowledge Circuit
Last week’s article was about a secret no one can read. But a secret the agent can’t leak is only half the problem. The other half is everything the agent does once it’s holding the keys. A credential kept perfectly safe is small comfort if the agent wielding it can be argued into misusing it.
This is the second stop on a three-part tech tour of the OpenMatter trust layer, one article for each product a workload passes through. Last week was Datavizor and the secrets beneath it; this week, QuantumGuard — the layer that governs what an agent is allowed to do, and turns “did it follow the rules?” from a post-execution audit into a pre-execution proof.
Next week we’ll be looking at the layer beneath the actions: how a model computes on data it never sees. But first, QuantumGuard.
Stay up to date as we build the infrastructure layer for secure AI collaboration:
OpenMatter is chairing the Decentralized AI Agent Alliance’s Agentic Privacy & Security subgroup. The next meeting will be held on July 29, 2026 at 1pm EDT, and continuing every other Wednesday thereafter. Please join us.
Enforcing Policy with a Circuit
QuantumGuard Turns an Agent’s Policy into a Proof That Every Action Was Allowed
Every security control is one of two things: a rule the system promises to follow, or a property the system can’t violate. The agentic era has been building the first kind and hoping it behaves like the second. Where that hope runs out is an agent’s actions: the moment it calls a tool, reaches an endpoint, or emits a payload into a downstream system, it has crossed a boundary, and the only thing that matters is whether crossing it was allowed. The reports of agents talking their way past the rules meant to stop them are piling up.
The two defaults for enforcing that boundary are the guardrail and the log, and both fail as primitives for the same reason: neither is binding. A natural-language policy handed to a model is a request rather than a constraint. It can be argued around, and increasingly it is. An allowlist in a config file is checked by the same runtime it’s meant to constrain, so a compromised runtime checks nothing. And a log is enforcement’s autopsy, not its pulse — useful only after the fact. None of them produces anything a third party could verify without trusting the system that produced it. To date, enforcement has been a property we hope holds rather than one we can check.
QuantumGuard’s premise is that enforcement should be a verifiable property of each action. It gets there by turning the policy into something a machine can prove against: a circuit.
Policy, Compiled
A policy — this agent may call these endpoints, must never emit these patterns, may use a secret but never transmit it unencrypted — is compiled into an evaluation circuit: a purpose-built program that runs inside a zero-knowledge virtual machine, built to take a policy and a proposed action and emit a STARK. The compile happens when a policy is written or updated, not when the agent acts; the resulting module is plugged into the gateway, and from then on every action crossing the boundary is evaluated against it. An action proceeds only if that run accepts it, carrying the proof the run produced. When the action violates the policy, no accepting run exists — and so neither does the proof, and neither does the action.
That chain inverts what enforcement means. A guardrail detects a violation and reacts, which means there is always a lag between the act and the response, and always the question of whether the detector fired at all. An evaluation circuit has nothing to detect: a violating action can’t come out of the evaluation with a proof attached, and without one it never crosses the boundary. Enforcement moves out of the runtime and into the math: it’s no longer a check the system performs but a property inherent to the proof.
The Enforcement Circuits
What that module evaluates is a policy surface of four checks, each a predicate over the action:
Output compliance fails for banned patterns or sensitive data before the payload is delivered.
Request sanitization separates the values that may never cross the boundary — tokens, API keys — from the identifiers a call legitimately needs to function, and proves the restricted ones were masked or removed while the call’s required structure survived intact.
Endpoint allowlisting clears an action only if its destination sits in the approved set, matched by exact membership. An agent scoped to a CRM and a calendar cannot reach a file-sharing API or a payment processor.
Access control binds every request to the session authorized to make it. At the start of a session the system commits publicly to the authorized identity; each subsequent data access is then proven to carry that same session identifier, with no conflicting identity appearing anywhere in the interaction. On a multi-tenant platform, this is what keeps one customer’s agent inside one customer’s data.
Narrow, total, deterministic — exactly what compiles cleanly into a circuit. That a policy has to be expressible this way is the discipline of the mechanism, not a limitation of it.
Why a STARK
The proof is a zk-STARK, and each of its three formal properties is essential to QuantumGuard:
Completeness: a compliant action can always produce an accepting proof, so the firewall never blocks legitimate work.
Soundness: a non-compliant action cannot produce an accepting proof except with negligible probability. This is the enforcement guarantee; there is no separate “block” branch to bypass, because the block is the absence of a proof.
Zero-knowledge: the verifier learns that the action satisfied the policy, and nothing else.
The natural alternative is a pairing-based SNARK, with smaller proofs and cheaper verification. But it’s disqualified by a single requirement: a SNARK needs a trusted setup, a ceremony whose secret parameters could be used to forge proofs forever after if anyone kept them. For a product whose whole thesis is minimizing who you have to trust, a setup ceremony you have to trust is a poor foundation.
A STARK asks for no such trust. It’s transparent — no setup, nothing to trust but a collision-resistant hash. Because it rests on hashing rather than the discrete-log and pairing assumptions Shor’s algorithm dismantles, it’s post-quantum: a certificate generated today doesn’t become forgeable the moment a useful quantum computer exists. And Fiat–Shamir makes it non-interactive, the prover deriving the verifier’s challenges by hashing the transcript, collapsing the exchange into a single certificate anyone can check offline.
Agent Monitoring, Redefined
When an action clears, the verifier learns exactly one policy-relevant bit — compliant — and nothing else. The certificate is zero-knowledge with respect to everything beneath it: the prompt that produced the action, the credential it used, the endpoint it reached, the tool it invoked, and the bytes it moved. Hand it to an auditor, a regulator, or a counterparty, and they can check it against the public policy circuit themselves, with no access to your infrastructure and no view of the data.
That changes the definition of monitoring. Your record of what an agent did is not a log the platform grants you with a promise backed by implicit trust. It’s a sequence of certificates, each independently verifiable, none of them a window into what it vouches for. Auditing the behavior stops requiring access to the data.
No Guardrails, Just Math
None of this needs you to rebuild the agent. QuantumGuard runs as middleware, speaking MCP and x402 natively, in one of two modes: real-time, where the proof gates the action inline, or audit-trail, where actions are proven and retained for later verification. You bring your own agent; the layer supplies the proof.
That modesty of integration sits on top of an immodest claim. For thirty years we secured systems by choosing whom to trust and hoping we chose well: the vendor, the model, the operator, and now the agent. Compiling policy into a circuit is a bet that the agentic economy needs something hope can’t supply — not a promise that the agent behaved, but a proof, verifiable by anyone, that a given action satisfied a given rule. QuantumGuard doesn’t fence the agent in. It requires every action to prove its own admissibility, and a non-compliant one can’t. In other words, there’s no guardrail waiting to catch the agent after it’s left the road; the math keeps it from leaving the road at all.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact our team to learn how masked compute can help.