Ask an AI agent what it did, and you get its own story: words explained by more words.
Experts call this the symbol grounding problem, named in 1990: if words are only defined by other words, where does meaning ever land?
For all practical purposes, we solved the symbol grounding problem: every word ends at an address in your specification, not at another word.
In plain terms: every action gets pinned to a spot in the instructions you wrote, not to the AI’s own account of it.
Run the same check twice and you get the same answer. We reran our latest 150 changes, and the answer has never once come out different.
For your engineer: npx -y thetacog-mcp@latest attest-demo (Measured: the walk returns the same bytes on a Mac and on Linux, Intel and Arm alike, in an open cross-architecture check anyone can rerun (IntentGuard, tests/cross_arch.rs).)
Read the full claim, and two ways to prove us wrong
Harnad's symbol grounding problem (1990) is a regress: words defined by words, forever. We end it on a closed floor. Twelve lanes of work, taken four deep, make 20,736 places, each owned by exactly one term of (A₁ + … + A₁₂)⁴, remainder zero. The walk across that floor only steps forward, so every definition stops by construction, within eight steps, at the same address on any machine. That is why the record we keep is a second set of books: today the only record of what an AI agent did is the agent's own log, which is letting it mark its own homework.
Meaning, here, is not a feeling. It is what you declared. The lattice is pulled from your own repository, so a change written in your specification's terms lands on your specification's address. A word you never declared has no address yet. That is not a failure of meaning; it is an undeclared term, and the receipt says UNMEASURED instead of guessing.
Two ways to prove us wrong, both public: find a definition on the floor that does not stop, or a change written in your own specification's terms that lands outside its lane.
AI doesn't get past the pilot stage until someone can insure it. The market agrees. From January 1, 2026, the standard liability forms let insurers exclude generative AI outright (ISO CG 40 47, CG 40 48, CG 35 08). Insurers won't carry what they can't count. If it's debatable, it's not insurable. We sell the count. Mapping a specification onto what was meant, and a new domain's terms onto the floor (software today; medicine, law and underwriting next), is the work we are scaling.
We detect, place, price and dispatch. You hold the wheel: the halt is yours to wire. The proof and the runs are below, and one command away.
iamfim.com — and I am… (doesn’t matter, this invoice comes with a steering wheel) · #!614-982-0603
You stopped because you already know the open secret: nobody can decide whether the output is right. Not the vendor, not the model, not another model — Rice proved it in 1953. Whether the agent should have done it is a judgement, and it stays yours. Where the machine landed against the line you drew is a tape measure, and a tape measure is the only thing a carrier can insure.Whether is yours. Where it landed is the tape.Nothing here grades your agent. You draw the line; the gate measures where it landed against it. The vendors selling you the tools are never the ones who get fired when they break.
Tell your devs: install ThetaCog Steer. Free and open-source (MIT), it runs on their laptop.
Every agent run is placed against the line you drew before it ran, on a record the agent did not write.
The steering the agent is handed, tick by tick: no more than 1 % of the spec it steers by, on 380 of 641 ticks. The two doors ↓debatable?
!insurable
If it’s debatable, it’s not insurable.
An underwriter cannot price what two experts can argue about.
Your agentics are writing to production right now. Somebody sold you AI that acts on its own, and nobody signed for what it does next.
And deterministic means chaos, by the way.
You hear that word and think obedient. It just means repeatable. If the conditions are exactly right, a perfectly deterministic agent will drop your production database and empty your corporate bank account — and it will do it with flawless, magnificent precision, every single time you run it exactly right.
1953: software cannot judge software. So paying a second AI to watch the first one is putting the getaway driver on the jury.
A deterministic autonomous system is a perfect oxymoron.
don’t take our word. recompute the receipt ↓
“What can I do?”
Start with your own tokens. On our own repo the agent steers by a spec that runs to 41 million tokens without carrying it whole: the steering payload it reads instead was 99% smaller than that spec on 380 of 641 ticks, and on the best 20% of ticks the steering payload was 99.85% smaller. That measures the size of what the agent reads beside the spec it stands in for. Your bill is a different reading, and we have not measured it yet.
This is the ingress: what the agent is handed to steer by is chosen, and on the record, before it acts. Each ramp down is one session’s steering piling up since the last /clear or compaction; each jump back is the reset.
Tell your devs: install ThetaCog Steer. Free and open-source (MIT), it runs on their laptop.
The same command runs on anyone’s laptop, including the other side’s. Point it at your own agents first. Hand the number up. Or, if you are the one who checks (counsel, an expert, a plan fiduciary), the check is free and runs without us.
Point it at yourself first: install ThetaCog Steer, the free VS Code extension (⇧⌘X, search “ThetaCog Steer”). Your own decisions stop being a story you tell about your work and become a position you can show — which is what makes you insurable, and is the same thing that makes you hireable. Not a promise about how you behave. Legible grip on how you decide.
We are hiring the ones who noticed. Coders, salespeople, underwriters. Forking it and breaking the illusion is the application.
That is the steering wheel, and it is the whole of what we sell: not a hand on the agent, a feel for the drift while it is still small. Nobody stops the weather. You are only ever on the hook for not checking it.
I build things. Install ThetaCog Steer · free →Then point it at someone else · give me the tapeVS Code ⇧⌘X, search “ThetaCog Steer” · or check it first: npx -y thetacog-mcp@latest attest-demo
Not the one who installs it? Forward this to whoever installs your tools — the install and the measurement are free and open-source (MIT); only the underwriting is licensed.
Keeping a second record costs seconds: the measurement is free and open-source (MIT), and only the underwriting is licensed. Its cost is published and dated, on purpose: 2.27 seconds to recompute a public receipt in a fresh clone (one run, 2026-09-28).
/goal is what you want finished. /steer is /goal with the record holding it — every ask a row, every row a guard, every commit placed, every worker cold-booted from the tree, and the session evicted when the goal closes.
“Am I personally liable?”
That standard is not ours and it predates every vendor in this market. In re Caremark (Delaware, 1996) put directors on the hook for failing to implement any reporting system at all; Marchand v. Barnhill (2019) showed the courts willing to enforce it. It is hard to win — bad faith, not negligence, since Stone v. Ritter (2006) — and a receipt is one input to a board process, never the process itself.
You do not need the agent stopped. You need to be able to prove you could have checked.
The director’s door →Get your board-ready number in 30 daysA scoped read of your live agents. You leave with your own exposure figure.
Pick one. We made it simple.
Still scrolling? Then neither door convinced you. Everything below is for you.
thetadriven.com/pricing — both doors, one checkout. →a · the tool
You asked an agent for one CSS class. It came back green, and the diff touched fourteen files. One line in your terminal shows the file it was never asked to touch.
The measurement is free and open-source (MIT), so you can read every line instead of taking our word for it. It runs on your machine, places where any agentic AI’s work landed against the line you drew, and signs a receipt anyone can recompute: same bytes, same hash.
npx -y thetacog-mcp@latest attest-demo · or install ThetaCog Steer in VS Code →
b · the insurable robot
The agent you already run: the one that answers tickets overnight, or opens pull requests while you sleep. When someone asks what it did, today the only answer is the log it wrote about itself.
One licence signs one agent’s runs for a year against the spec it was given. The receipt is a record the agent did not write, and that record is what a carrier can price. Whether the work was good stays undecidable (Rice, 1953); where it landed does not. The licence is the paid half: $20 per agent-year.
Leave your email in the box below ↓Do you worry about $1.2B in AI liability?
a number we can call — or an email, or an idea
Leave your email. Answer the one email that comes back with one sentence on what repo or runtime your agent touches, and you run it on that agent with every run countersigned for a year: one licence, one per address, 25 in all. If it isn't yours, who does this make you think of?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
The backstage pass.
Both doors are a leap — a licence, a fork, a named exposure. The club is the rail: one passage a day from the main line of the work, chosen by the instrument for whatever the work is wrestling with that morning, with the day’s receipts riding along. You watch the argument get built before it is dressed for the stage — so when this reaches television, you will already know which of the people explaining it are useless and which are merely clueless. Which is which depends on your coordinate, not on them.
It costs nothing, and it is not a free tier. The measurement was always free; this is a seat in the room where it gets made.
read the archive first — every edition, in the open, with its receipts.
The deployer buys
One licence per agent they run, $20 a year, metered at 365 days or ten thousand attestations — whichever arrives first.
The insurer buys
The same licence, at the same terms, held as inventory against the book they are writing. Not a different product. Not a different price.
Both sides of the trade hold the same instrument. That is the only reason either side should believe the number.
The code is open — github.com/wiber/thetacog-mcp — so that you can read every line instead of trusting us, and so that a receipt recomputes on a stranger’s machine with nothing of ours in the room. What the licence buys is the seal that makes a run count. The building code is free to read; the inspection stamp is not.
The same check is open to whoever the record lands in front of: the plan fiduciary who pays the administrator, the underwriter pricing clean risk, counsel and experts on either side, advocates for the people affected. A receipt is sufficient for where the agent’s work landed against a lane declared before it ran, recomputed from the immutable commit, a record the agent did not write. It is not sufficient for whether the work was good; that is undecidable (Rice, 1953), and we do not claim it. Free under MIT, on your own machine: npx -y thetacog-mcp@latest attest-demo
An unsigned testimonial
“I am the one holding the bag when our AI breaks a client contract. Every change our agents make now carries a receipt the machine did not write, one my carrier can recompute.”
— ______________________________
Would you put your name on this? Would your boss? Would anyone you know?
This is not an IAM.
Identity & Access Management
This is a recomputable placement that feeds into your IAM; whether a decision is defensible is for counsel, and this is the record counsel reads.
what it feeds, and why that is the whole product →Do you worry about $1.2B in AI liability?
a number we can call — or an email, or an idea
Leave your email. Answer the one email that comes back with one sentence on what repo or runtime your agent touches, and you run it on that agent with every run countersigned for a year: one licence, one per address, 25 in all. If it isn't yours, who does this make you think of?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
That is not a shortage of nerve on the underwriter's part — it is the definition of an uninsurable risk.
So the question is never whether the AI is good. It is whether anything about it is decidable at all. That is the part we can actually answer.
IAM-FIM
Fractal Identity Access Management
IAM proves your agent could get in. It can't prove your agent stayed in its lane.
Stop adding reviewers to catch the drift — another model in the loop can't prove itself either. One layer can: a placement at an address, re-runnable from the commit. Here it is, in one command:
You don't have to take my word for it · run it · free · one command
On a phone? Tap the command to copy it, or mail it to your desk — it takes ninety seconds when you get there.
One install puts a placement on every proposed action: where it landed against the lane you declared. If you can use a chatbot, you can deploy it.
The agent proposes, the gate measures, you sign — the keys never enter the model's context. The receipt recomputes on your own machine to the same answer every time. Nothing to trust, nothing leaves your box.
Your AI liability is uncapped right now. The generative-AI endorsements (ISO CG 40 47 and CG 40 48, effective 2026-01-01) sit on general-liability paper, and a condition nobody can evidence is a claim nobody can collect. Since 2 August 2026 the EU AI Act has required deployers of high-risk systems to keep human oversight effective (Article 14) and to retain logs that make an autonomous decision traceable after the fact (Articles 12 and 26). It does not hand you a bill. It removes the sentence “nobody could have known.” You cannot solve an uncapped number with skin in the game — staking your own balance sheet against agent drift is self-insurance under a newer word, and self-insurance scales by deploying less. It keeps the cars in the garage. The one thing that caps it is a record you can prove.
You're pushing thousands of automated decisions an hour to hit your efficiency targets. Your logs prove a write happened — not that the agent stayed in its lane when it did. If a regulator or a class-action ever looks under the hood, that gap is exactly what they find — and no bigger model closes it. Right now you're running on probabilistic hope. Approvals per person grow as agents per employee times steps per agent, and the share of steps anyone reads shrinks with it.
The discovery maps where that exposure actually sits in your stack — the microsecond an agent writes to a record without a provable lane — before someone else maps it for you.
A scoped read of your live agents — you walk away with a board-ready figure for how exposed you actually are (your number, not a sales quote) and the method behind it. Nothing to implement.
or, before you book, prove it to yourself: run the 3.4σ proof · read the manual
the proof underneath — if you want the why
Why a checker can't be more software. Turing proved software can't decide whether another program halts; Rice generalized it to every non-trivial property of code. An auditor written in software shares one failure domain with the thing it audits — a broken mirror checking a broken mirror. That's why "just add another model to review it" never closes.
Why it has to drop to hardware. Ashby's law: a system only holds a stable path when an external substrate absorbs its excess freedom — the way a moving bicycle borrows the road it can't get from standing still. Software-only AI has no road. So the permission is carved into an address instead of a sentence: a coordinate in a fixed lattice, where crossing a semantic boundary is a physical cache-line crossing the model never chose — read from userspace as latency, measured rather than asserted.
Why it prices. It isn't search, and it isn't a wager — it's O(1) reach-is-verify: one cache line, one coordinate, the same fetch the agent already made to act. Audited at 3.4σ separation, reproducible on your machine in 90 seconds. For the underwriter that's priceable per-inference; for the CTO, zero verification overhead on the revenue path; for the safety lead, nothing for the model to fool. See the audited proof →
What we do not claim. Not that the agent behaves. Not that the work is correct — that question is undecidable (Rice, 1953) and any vendor telling you otherwise is selling you a 1953 theorem they have not read. We claim four things and they are all checkable: the deviation is detected, placed against an intent declared before the work ran, priced, and dispatched. Where it landed is provable and re-runnable. Whether it was a good idea is yours.
And the receipts are not ours to grade. Every commit this system makes renders its own — several thousand of them, one per commit, each re-runnable from that commit, same bytes, same hash, with no model anywhere in its path. Recompute one and you will get the byte you would have got from us, which is the only property that matters: the record you are reading was not written by the party it audits.
License the floor · per agent you run
Running the gate is free — that is the lighthouse, and it stays lit. Paying is the bonus.
When you run agents in production under the patent, you take a license — one per agent you run, billed annually. The price is set, and it never goes up.
built and answered for by
Elias Moosman — inventor, US Patent App. 19/637,714
LinkedIn · #!614-982-0603 · elias@thetadriven.com · join the crew
iamfim.com • Trust Physics • US Patent App. 19/637,714, filed Apr 2, 2026