Zynth Assurance
Governance you cannot test is a press release
Zynth Assurance provokes a real deployment on a schedule — containing a live agent, spending a budget to its limit, refusing a delegation that tries to widen — and scores every leg against what it actually saw.
- 6h
- Containment drill
- 4h
- Autonomy drill
- 15d
- Soak, in flight
Watch one
Ten legs, and one of them is not green
The containment drill, every six hours, against a real deployment. Each leg names the observable that proves it — select one to see what the run actually saw.
step 7 of 10
The kill switch actually bites
PASSsaw
the agent's ALREADY-ISSUED token answers 401 on GET /api/v1/me, and a fresh mint answers 403
The verdict that matters
A drill that proves nothing and reports success is worse than no drill
Most test suites have two answers. This one has four, and the fourth is the reason to trust the other three.
- PASS
- The leg's named observable was seen. Not 'no error' — the specific thing, by name.
- FAIL
- It was looked for and it was not there. A control did not do its job.
- GATED
- Switched off by deliberate configuration on this deployment. Not a failure and not a pass.
- UNPROVEN
- Could not be scored at all. Reported, never skipped — because 'we did not check' must never read like 'we checked'.
And the rule underneath them: a run in which no leg passed exits non-zero even if every single row is a legitimate GATED. A report cannot get shorter by dying halfway, because the roster is declared by the scorer rather than accumulated by the driver — a leg with no record reads UNPROVEN, never absent.
What it does to us
These are not synthetic checks
The drills act on real principals in a real deployment, and clean up after themselves by construction.
It contains a live agent
The drill registers an agent, makes it touch a decoy, takes the detection through the real human-approval loop, then engages the kill switch on that agent — and releases it afterwards, even when a leg has already failed.
It spends a budget to the limit
A task token is issued with a budget of ten. The run fires eleven reads. The eleventh being refused is the pass — anything else is the failure.
It earns a circuit-breaker trip on purpose
One agent in the soak fires fifty-one denied calls a day until the blast-radius breaker trips, then releases its own kill switch so it can do it again tomorrow.
It runs as a governed principal
The tester holds its own delegations, is journalled and budgeted like any other agent, and is containable by the same kill switch it exercises. It has no database credential for the system it tests.
Where the scenarios come from
Every failure we have had is now a test we cannot delete
The catalogue is not imagined. It is derived from this platform's own post-mortems, by inversion, and CI turns an unclassified one into a red build.
670+
post-mortems classified, each one reproducible, a principle, or explicitly neither
160+
scenarios that trace back to something that actually went wrong here
every
destructive scenario must declare how it releases, or the registry refuses it
A scenario cannot be added without provenance — a recorded incident, an industry reference, or it is refused at registration. The list of families is the directory itself rather than a typed roster, so a new one is in the catalogue the moment it exists. The effect is an institutional memory that cannot quietly shrink: forgetting a lesson here requires deleting it in front of a reviewer.
Its own product
Assurance is not a feature bolted onto the platform. It is a second product that happens to point at the first.
Its own service. Its own catalogue. Its own signed evidence. It holds no database credential for the platform it tests — it watches Zynth Auth from the outside, as a governed agent with delegations of its own.