Cómo funciona HELM

Key idea: HELM is a proxy that sits between your AI agent and its tools. Every tool call is policy-checked and produces a cryptographic receipt — creating a tamper-proof audit trail you can verify offline.

The pipeline

Every tool call passes through four stages:

1. Intent Capture

The agent declares intent to invoke a tool. HELM captures:

• Tool name and arguments
• Caller identity
• Timestamp and Lamport sequence number (monotonic causal order)

2. Policy Check (PEP)

The Policy Enforcement Point evaluates the call against your policy rules:

Request → Schema validation (CPI) → Policy rules (PEP) → Verdict

Evaluation is deterministic — same input always produces the same verdict. Rules are evaluated in order. First match wins. If no rule matches, the default is DENY (fail-closed).

3. Verdict

The Guardian produces a DecisionRecord:

4. Receipt

A cryptographic receipt is appended to the ProofGraph:

Three guarantees

Fail-closed

If anything goes wrong — unknown tool, invalid schema, policy engine error — the default is DENY. There is no code path from model to tool that skips the PEP.

Deterministic

Same policy + same tool call = same verdict. Always. No probabilistic gates, no LLM-in-the-loop decisions. JCS canonicalization (RFC 8785) ensures identical serialization.

Offline-verifiable

Anyone with the receipt chain can independently verify:

1. No receipts were removed — PrevHash integrity check
2. No receipts were reordered — LamportClock monotonicity
3. No receipts were modified — SHA-256 + Ed25519 signature

Next steps