PROOF · RECORDED ON OUR OWN ENVIRONMENT · OCTOBER 7TH, 2026

WHICH ONE DID THIS?

A university security engineer asked us a plain question this fall. If a hundred AI agents were connected and one of them started doing something odd, could he tell which one? Not which model, not which key. Which running copy.

This is the answer, recorded on our own console. Seventy-seven seconds, captions on screen.

What you are watching

Two copies of the same AI agent start on one server and check in on their own. Nobody registers them by hand. Both use the same key, on purpose: a key tells you a fleet is connected, it does not tell the copies apart. The install does.

Each copy then tries the same six actions. Listing files and reading a file are allowed. Sending an email is held for a person. Running code fetched from the network, deleting a directory, and writing a file with a Social Security number in it are blocked. Every decision is checked before the action runs, and every decision goes on the record with the copy that asked.

Pick one copy in the record and you see only what it did: two allowed, one held, three blocked. Pick the other and you see its own six. Open any decision and the copy that made it is on the card. Each copy has a page of its own, with what it is running and a link to everything it has done.

Then the held action. It waits in the queue with a clock. A person opens it, sees six ways to answer, and picks "allowed, just this once." The agent runs the action. The record names who said yes and which copy raised it.

Why it matters on a campus

Agents on a campus arrive in copies: one per department, one per lab, one per sandbox that spins up for an afternoon. The identity layer sees one key. The audit question is about one copy. If the record cannot tell them apart, the first sign of trouble is the damage, and the second is a week of log archaeology.

With the check on the action, the answer is a filter. Which one did this? That one. Here is everything else it did. Here is who approved the thing it was waiting on.

What we do not claim

This is a recorded run on our own tenant, not a customer's. The agent was a reference copy driven with the calls it makes, not a production workload. It shows what the record holds; it does not show how often a real campus would hit a hold. The university that asked is not named here, by its own rules, until it says so.

The ask

Run this against your own agents. The free door is one guardian on one agent in your environment for 30 days, with your own rules and your own logins. The paid door is a 30 day proof of concept against the one action you would least want an agent to take on its own, with a written findings review for your auditor.

Book a demo and bring the action you would want to see stopped.

Recorded on

Our own environment, October 7th, 2026. Two copies of the Hermes agent integration on one virtual machine, checked against the Mountain Theory console. Ten screens from the test, captioned, no edits to what the screens show. The narration is Mike May's voice, cloned with his consent, and the presenter in the corner is a generated likeness of him. The test notes, the scripts and the stills are kept; ask and we will walk you through them. The protocol every run on this site is published under: the Recorded Run Protocol. Every other recorded run: Proof, on the record.