The execution layer for AI.
11/11 AI is sovereign runtime infrastructure that governs whether an AI, agent, or autonomous system is allowed to act, before the action reaches the real world. Pre-execution authorization. Fail-closed enforcement. A signed, verifiable record of every governed decision.
Live, fail-closed, and post-quantum signed. Not a sandbox demo: send one unauthenticated request and verify a real signed governance decision yourself, no login required.
Open source, Apache-2.0
Built for developers. Verified by anyone.
npm install @11ai/execution-governance
Fail-closed authorization for AI agent tool calls, allow or deny before execution, with a signed receipt for every decision. Apache-2.0, no API key, no telemetry.
Not a demo. A public endpoint.
Everyone else ships a demo. We ship proof you can run.
One unauthenticated request returns a real governance decision with its component hashes and a signed evidence root. The signatures verify, including the post-quantum ones. No wrapper, no login, no mockup.
Verified independently on 6 August 2026 using liboqs. These badges report that recorded result. They are not a check performed by this page.
$ curl -s https://control.11aiblockchain.com/v1/public/evidence \
| jq '{decision, execution_id, ea11_evidence_root,
signatures: .hybrid_signature_envelope
| {ed25519: .ed25519.status, ml_dsa: .ml_dsa.status,
sphincs_plus: .sphincs_plus.status}}'
{
"decision": "APPROVED",
"execution_id": "EX-773FCDB1",
"ea11_evidence_root": "3942d2e38c34296bd8a6290713a4c405b4b15f1ee83c25b44dbd551d4d24078c560d3a481ebc717964d0690dacde18fc069abf25fdc0866d2650fb36f43c1984",
"signatures": {
"ed25519": "SIGNED",
"ml_dsa": "VALID",
"sphincs_plus": "VALID"
}
}
We are the permission layer between AI and the real world.
An AI decides to do something: move money, change a record, run a command, take an action. Before that action can happen, it asks 11/11: "Am I allowed?" If the answer is no, the action is stopped. If yes, it proceeds and we keep an append-only, hash-chained record of the decision, signed on retrieval.
Most AI systems act first and get checked later. By then the damage is done. 11/11 checks first, every time, typically in under a tenth of a second. That is the whole idea.
The missing layer in AI infrastructure
Today's AI executes first and is inspected later.
By the time misuse, drift, or unauthorized action is detected, the action has already occurred. Logs are not authorization. Observation is not enforcement. Post-hoc review is not control.
11/11 reverses the order. We sit between the AI decision and real-world execution, and decide whether it is allowed to happen at all.
AI executes on probability
No control, actions occur before approval. Systems observe but do not stop behavior. Logs are not reliable evidence.
AI executes on authorization
Identity and policy are checked first. Fail-closed runtime control stops unauthorized behavior. Cryptographic evidence is recorded after.
How it works
Evaluated before. Enforced during. Proven after.
Every action is evaluated before it executes, enforced while it runs, and recorded after it completes. It is fail closed by design and enforced in line, subject to independent verification.
Submitted
Identity, action, environment, and tenant are bound to the request.
Policy
Evaluated against the tenant's active policy set.
Allow / Deny
An Ed25519 authorization artifact is issued, or denied.
Runtime
Fail-closed enforcement boundary. No artifact, no execution.
Audit
SHA3-512 + BLAKE2b-512 evidence chained, hashed, and published.
# A denied request, signed { "tenant_id": "tenant_1111", "decision": "DENY", "verified": false, "reason": "missing resource", "timestamp": "2026-08-06T21:52:49.190Z", "hash_algorithm": "SHA-256 + SHA-512", "signature_algorithm": "Ed25519", "signed_fields": [ "execution_id", "tenant_id", "decision", "verified", "trust_score", "required_trust_score", "reason", "timestamp" ], "ed25519_signature": { "algorithm": "Ed25519", "status": "SIGNED", "kid": "ea11-ed25519-public-2026", "public_key_ref": "/.well-known/jwks.json" }, "audit_persisted": true }
Real decisions, not mockups
The cryptography is named, not implied.
11/11 publishes the exact primitives used at every layer of the control plane. Reviewers do not have to guess. Every governance decision returns a hashed response typically in under 100ms; the evidence root is signed with Ed25519, ML-DSA-87 and SLH-DSA-SHA2-128f when the record is retrieved, verifiable against the live machine-readable proof endpoint.
- ✓ Both ALLOW and DENY paths are recorded and persisted to the audit chain, and both are signed when retrieved. Recording the denial is the part almost no system does.
- ✓ Multi-tenant isolation enforced per request, no cross-tenant leakage, no replay.
- ✓ Each public claim is paired with a way to verify it, or marked as roadmap.
Verify it yourself
No API key required.
The execute endpoint above is authenticated, but the verification surface is fully public. Fetch the signing key and a signed evidence record, then verify the signature yourself, reproducible by anyone against the public proof ledger.
- ✓ Public Ed25519 verification key via JWKS
- ✓ Signed evidence record from the live ledger
- ✓ Verify the signature, no credentials needed
Open-source verifier: clone and run in 30 seconds
The verifier checks Ed25519 with no dependencies. To check the post-quantum signatures, install liboqs-python and the same script verifies ML-DSA-87 and SLH-DSA-SHA2-128f locally. It tells you which signatures it checked and which it skipped, rather than reporting a pass it did not perform.
# 1) public Ed25519 verification key GET control.11aiblockchain.com/.well-known/jwks.json # 2) signed evidence record GET control.11aiblockchain.com/v1/public/evidence # 3) verify the signature against the JWKS key # reproducible by anyone, no API key needed
Built as a control plane
Four layers. One enforcement boundary.
Who is acting
Every actor is cryptographically bound to the request before anything proceeds.
What is allowed
Tenant policy is evaluated before execution begins, deterministically.
Fail-closed enforcement
The action does not proceed without authorization. Default is deny.
Verifiable evidence
Ed25519 signed, SHA3-512 plus BLAKE2b-512 chained, public proof endpoint.
Where execution governance matters
Infrastructure for systems that cannot afford to execute first.
AI Agents & Autonomous Systems
Gate every tool call, model action, and orchestration event before it occurs. Deterministic authorization keeps autonomous systems inside approved policy, trust, and runtime boundaries.
Explore Governed AI →Defense & Sovereign AI
Fail-closed authorization for regulated, sovereign, and mission-critical compute. Cryptographic execution controls for mission-critical AI and strategic national infrastructure.
Financial Infrastructure
Gate high-value transactions and settlement actions before they execute, with per-tenant isolation and signed proof of every decision. Direct payment-rail and stablecoin integrations are on the roadmap.
Critical Infrastructure
Cryptographic authorization and deterministic governance for industrial control systems, automation, and grid-adjacent compute environments.
Healthcare & Clinical AI
Enforce HIPAA-aligned decision boundaries before patient-impacting actions occur, with audit lineage and fail-closed operational controls.
Government & Regulatory
Cryptographic execution controls for public-sector AI and regulatory automation requiring sovereign accountability and policy-bound execution.
Sector FAQ
Answers for the systems that cannot fail.
How execution governance applies where the stakes are highest: defense, finance, and healthcare.
Defense & Sovereign AI
How does 11/11 support sovereign or mission-critical compute?
Can every decision be proven later for audit?
Does it govern autonomous defense systems?
Financial Infrastructure
Can it authorize transactions before they settle?
How fast is a governance decision?
How is one client isolated from another?
Healthcare & Clinical AI
Is 11/11 suitable for clinical AI?
Does it support compliance requirements?
What happens if authorization is missing?
Intellectual property & chain of title
A new category, defensibly owned.
11/11's architecture is covered by patent applications filed with the USPTO under Customer Number 229939, pending. Core governance and medical control-plane applications are assigned to the 11 AI Blockchain Developments Land and IP Trust.
AI Cryptographic Governance
Non-provisional governance and execution authority architecture.
Execution Authority Continuation
Expanded enforcement boundary and runtime authorization claims.
MedPlane AI
Governed medical and clinical execution infrastructure.
Execution Governance™ / Governed Execution™ / EA-11™ / Execution Arithmetic™ / Execution Evidence State™ / U.S. Patent Pending. Core governance, authorization, lineage, and fail-closed execution systems.
Mission
"Execution is impossible without authorization. This is enforced, not observed."
11/11 is not building another AI application. We are building the infrastructure layer designed to govern AI execution itself, the way identity, networking, and encryption became foundational layers of the modern internet.
Why "AI security" doesn't govern anything
Security watches. Governance decides.
Every observability, monitoring, and "AI security" tool shares one assumption: the action already happened, now let's inspect it. By then it's real. 11/11 makes the decision before the action reaches the world, and refuses it if it isn't authorized.
detect after execution
- ✗ Acts first, inspects later. Damage is already done
- ✗ Logs and alerts: a record, not a decision
- ✗ Probabilistic anomaly scoring, not deterministic allow/deny
- ✗ Can observe a bad action; cannot stop it
- ✗ "Fails open": when it breaks, execution continues
- ✗ Evidence assembled after the fact, mutable, disputable
authorize before execution
- ✓ Evaluated before the action reaches the real world
- ✓ A signed allow/deny artifact: an enforced decision
- ✓ Deterministic policy evaluation, typically <100ms
- ✓ No artifact, no execution: the boundary holds
- ✓ Fail-closed: when in doubt, default is deny
- ✓ Ed25519-signed, hash-chained proof on every decision
Logs are not authorization. Observation is not enforcement. Post-hoc review is not control. If a system can only tell you what an AI did, it never governed it.
The hard questions, answered first
What happens when something goes wrong?
Reviewers in defense, finance, and healthcare don't ask whether the happy path works. They probe the failure modes. Here are the ones we get asked most, and what the architecture actually does.
The action does not proceed. Fail-closed means absence of authorization is a denial, not a default-allow. Downtime degrades to "nothing executes," never to "everything executes."
The control plane is fail closed by design and enforced in line, subject to independent verification. Without a valid signed artifact bound to the request, the runtime boundary refuses to act. No artifact, no execution.
Each decision is Ed25519-signed at the moment it is made, over an enumerated field set, and hashed with SHA-256 and SHA-512. Altering a signed decision record invalidates its signature. Separately, the evidence root published for a record is signed on retrieval, and the open-source verifier checks that signature. We are currently making that root recomputable from its component hashes so component-level tampering is detectable too. Until that ships, this page says so.
Every artifact binds to a tenant at issuance. Policy, audit chain, and decision hash are tenant-scoped, with no cross-tenant leakage, no replay.
✗ Not a model, an agent, or another AI application
✗ Not a firewall, SIEM, or monitoring dashboard
✗ Not post-hoc logging dressed up as control
✗ Not a guarantee an action is wise, only that it was authorized
✗ Not a guardrail you can prompt your way around
✗ Not "best-effort", the default is deny, by construction
Operating, not slideware
A live system with a public record.
No demo wrapper, no anonymized logos we can't back up. The evidence is the thing itself: a real authenticated gateway plus a public verification endpoint, patent applications on file, and an open research corpus anyone can reproduce.
Public health and proof endpoints are live. Each public claim is paired with a way to verify it, or marked as roadmap. verify public proof →
Anchor filings for AI Cryptographic Governance, Execution Authority, and MedPlane AI, assigned to the 11 AI Blockchain Developments Land and IP Trust.
An ongoing briefing series documenting live runtime authorization, denial, and lineage events. read the briefings →
DUNS 144921555 · UEI GHEZH441JN51 · CAGE 1A1G9 · USPTO Cust. 229939 · ORCID 0009-0003-0688-4265
We wrote the standard, not just the patent
Read the doctrine. Reproduce the proofs.
Categories are owned by whoever writes the spec. The Execution Governance doctrine is published openly, eight sequenced principles, a 71+ record research corpus, and the live proof to back them.
Control AI execution before it happens
Verify the system yourself.
Each public claim is paired with a way to verify it, or marked as roadmap. No demo wrapper, no slide-only diagram. Health and proof endpoints are public; the execute endpoint requires an API key.