The Decision Quality Layer

You wouldn't hand ChatGPT your credit card and tell it to book a trip to Paris.

You could. The technology has been there for at least a year. Claude Computer Use and similar agent frameworks can already navigate booking sites and complete checkouts. Comet, Genspark, and others promise the same. The APIs are ready, the payment rails exist, the browsers can drive themselves.

And still — almost nobody does it.

Not because the agents can't. Because you don't trust them.

That gap between can and would is the most important unsolved problem in the agent economy right now. And it's not a security problem. It's not an authorization problem. It's not an identity problem. Those layers exist. They work.

It's a decision quality problem.

The four questions

Every autonomous agent action that touches the real world is really four questions stacked on top of each other.

Is the user real? That's identity. World, Persona, Alloy. Answered by proof-of-personhood and KYC.

Is the action authorized? That's authorization. Google's AP2, now stewarded by the FIDO Alliance. Answered by cryptographic mandates that prove the user signed off on this class of action.

Is the action safe? That's security. Blockaid for crypto, HUMAN Security for bot traffic. Answered by pattern matching, transaction simulation, behavioral classification.

Three questions. Three layers. Each of them well-funded, standardizing, being solved.

Then there's the fourth question, the one nobody is asking out loud yet:

Is the action a good idea?

Not "is the user allowed to do it." Not "will the transaction go through safely." Not "is it a human or a bot behind it." But: given this specific user, this specific context, this specific plan the agent came up with — does the plan actually make sense?

That question has no layer. No standard. No dedicated infrastructure. And that is exactly why you don't hand ChatGPT your credit card.

What the missing layer actually does

Let me make this concrete.

Imagine you tell your agent — Comet, Claude, ChatGPT, doesn't matter which — to book a flight to Paris with a hotel in the center, budget under 800 euros total.

The agent goes off. Twenty seconds later it comes back with a plan: Ryanair to Beauvais, transfer to central Paris, a hotel called Hôtel du Marais. Total: 512 euros.

Authorization layer says: yes, the user authorized "book me a flight and hotel under 800 euros." Green.

Security layer says: yes, the payment is going to legitimate merchants. Not a drainer. Not a phishing site. Green.

Identity layer says: yes, real user on the other end. Green.

Three greens. Payment sheet appears. User taps confirm.

Except:

• The transfer from Beauvais to Paris takes 90 minutes and costs 40 euros the agent forgot to add.
• Hôtel du Marais isn't in the Marais. It's in the 19th arrondissement, 45 minutes on the metro from anywhere the user wanted to be.
• There's a direct Lufthansa flight at the same time for 20 euros more that would land at CDG, 20 minutes from the actual Marais.

Every authorization was correct. Every security check passed. Every identity claim was true. And the user is about to buy a bad trip.

That is the decision quality problem. Every layer we already have answers a different question. None of them answers this one.

What we're building

At ThoughtProof we've spent the last months building the Decision Quality Layer. At its core is Sentinel — a fast, independent check that runs on every agent decision in a few seconds, before you commit. It takes the plan one model produced and has a different model examine it adversarially. Not for policy compliance. Not for pattern matches. For quality of thought. When the stakes are high — a large payment, an irreversible action — it escalates to RV, a deeper adversarial panel where several independent models pull the plan apart. Same question at both tiers, at the speed each moment can afford: is this plan actually sound?

The principle is domain-agnostic: wherever an agent produces a plan, Sentinel can judge whether the reasoning behind it holds — before the plan turns into an action. We've put that to the test in high-stakes settings where a flawed plan has immediate, measurable consequences, and published the results separately. See the live verification experiment →

Now we're bringing that verification to the layer where it matters most for regular people: the last moment before an agent commits an action on your behalf.

Concretely, two things launching this quarter

A browser extension for Chromium-based agent browsers — Perplexity Comet, Genspark, and regular Chrome or Edge with agent-mode enabled. When any of those agents is about to complete an action — a booking, a payment, a bulk email, a form submission — the extension pauses the action, sends the plan to Sentinel, and shows you the verdict before you commit. Not "safe / unsafe." Not "allowed / denied." A structured judgment: this plan has the following weaknesses in its reasoning — so you can decide, or send it back to the agent to revise, before anything executes.

An MCP proxy for Claude Desktop, Cursor, VS Code Copilot, and any other Model Context Protocol client. Every tool call your agent wants to make goes through Sentinel first. If the tool call is sound, it passes through invisibly. If it isn't, you get an elicitation dialog with the objections — what in the reasoning doesn't hold — before the call runs.

Neither of these is a new agent. We are not competing with Comet or Claude or ChatGPT. We are the layer that sits between you and any of them, doing the one thing they cannot do for themselves: independently judging whether their own plan is a good one.

Why an independent layer

Here is the argument for why decision quality has to be its own layer, and not a feature inside each agent.

The verification has to be adversarial. If Claude verifies Claude, or ChatGPT verifies ChatGPT, the model has already been trained on the same data, made the same shortcuts, encoded the same blind spots. When one part of the model plans a trip via Beauvais, another part of the same model is likely to agree that it's fine.

That's not verification. That's affirmation.

Real verification requires another mind. In our engine that means a different model, prompted adversarially, given the plan as input and asked what a competent skeptic would find wrong with it. Sometimes it's a stronger model. Sometimes it's a differently-trained one. Sometimes it's a cascade of them, weighted. The point is: not the same one that made the plan.

That kind of layer cannot live inside the agent. It has to live outside of it. It has to be model-agnostic and platform-agnostic. It has to be able to look at Comet's plan and Claude's plan and Cursor's plan with the same eye.

Which is exactly what a "decision quality layer" means as a category, and why it belongs alongside identity, authorization, and security — as an independent function, not as a feature of any specific agent.

What this is not

To keep things sharp, five things this layer is deliberately not:

It is not authorization. AP2 already does that, well, and it's now a FIDO standard. Sentinel doesn't ask whether you signed off on a class of actions. It asks whether this specific instance of the class is a good execution.

It is not security in the transactional sense. Blockaid checks whether a crypto transaction leads to a drainer. Sentinel checks whether the transaction — safe or not — actually accomplishes what you wanted.

It is not bot detection or agent trust. HUMAN Security's AgenticTrust tells a website operator whether the agent talking to their server is legitimate. Sentinel tells you whether the plan your legitimate agent came up with is any good.

It is not an agent operating system. Sentinel doesn't care what environment your agent runs in. It examines the plan, wherever it comes from.

It is not a developer guardrail. Patronus, Fiddler, and other guardrail products let developers building agents add runtime safety checks to their own systems. Sentinel is for end users — regular people, prosumers, knowledge workers — who use other people's agents and don't have a developer team.

Those five layers are all valuable. All of them are being built by good teams. None of them answers the question we're trying to answer.

The five checks

For the extension and the MCP proxy we've defined five action-agnostic checks that Sentinel runs on every plan, in a few seconds, regardless of domain. Booking a flight, sending 47 emails, deploying code, moving files, canceling meetings — the same five questions apply. (When a decision carries real weight, RV runs the same five deeper, with a full adversarial panel.)

Intent match. Does the plan actually solve the request, or is it a plausible-sounding detour? "You asked for the cheapest flight. This plan books business class."

Consequence awareness. Does the plan recognize all irreversible side effects? "This plan sends an email to 47 recipients. Did you mean to?"

Constraint compliance. Does the plan stay within your stated bounds — budget, time, blacklists, whitelists? "Budget cap is 500 euros. Plan totals 512."

Plausibility. Are the numbers, prices, times, and facts within a reasonable range? "Price is 220% above median for this route in this window."

Alternative existence. Are there obviously better alternatives the agent missed? "There is a direct flight for 20 euros more that saves 90 minutes and lands closer to your destination."

Why now

Three things are converging.

Agent capability has crossed the threshold where "the agent can technically do this" is no longer the bottleneck. The bottleneck is trust in the specific plan.

Authorization is being solved as a standard. AP2 exists and is spreading. In two years, the machinery for "did the user permit this" will be commodity.

Security and identity are being solved as products. Blockaid, HUMAN, World, Persona, Alloy — these companies are well-funded and moving fast.

Which means the last remaining question — is the plan any good — is about to become the visible bottleneck. It's the one thing standing between "agents can do it" and "agents actually get to do it for real people, with real stakes."

That's the layer we're building. Decision quality. Independent. Model-agnostic. In front of every action.

What you can do

If you use Perplexity Comet, Genspark, or Chrome with an agent extension, the ThoughtProof extension will be in the Chrome Web Store in the coming weeks. Join the waitlist.

If you use Claude Desktop, Cursor, or another MCP client, the MCP proxy will ship as an npm package with a one-line install. Same waitlist.

If you're a developer building agent systems on OpenAI Agents SDK, LangGraph, or Claude Computer Use, the Sentinel API is already live at sentinel.thoughtproof.ai and you can integrate directly.

If you're an investor, an operator, or a builder thinking about this space — get in touch. This category is going to have more than one player, and we'd rather define the space together than watch it fragment.

ThoughtProof is a Wyoming LLC founded in 2026, building the Decision Quality Layer for autonomous agents. Sentinel is the fast per-decision check that powers it, with RV for high-stakes deep verification and PLV for regulated environments.