Whitepaper

An autonomous agent is a program that spends money without a person watching it. Two things follow. It needs a hard spending limit that does not depend on anyone noticing a runaway loop, and it needs to send material — customer records, private repositories, unreleased work — to a model host that has no business reading it.

Most inference providers solve neither. They bill after the fact against a total you cannot verify, and they keep your prompts by default so they can debug, moderate, or train.

The client wraps the request body with a key derived per call. The gateway routes on the envelope alone: model id, key id, unit estimate. It can schedule and bill a request it cannot read.

Unsealing happens once, inside the execution frame, for the duration of one call. The plaintext lives in memory that is released before the frame returns and is never written to durable storage.

On the sealed tier the execution frame runs on hardware that produces a measurement of the code loaded into it. That measurement is signed by the platform, not by us, and is embedded in the receipt. A caller who does not trust Sableum can still check that the frame which unsealed their request was running the build we published.

Each response returns a receipt: model, unit counts, duration, key id, the frame measurement, and a signature over all of it. Receipts are the billing record and the privacy proof in one object. They contain no prompt text, no completion text, and no file contents — which is what makes them safe to keep, export, and hand to an auditor.

A key carries its own ceiling. The gateway decrements it before dispatch, not after settlement, so a key cannot overshoot by racing itself across concurrent calls. Exhaustion is a plain error the calling agent can handle, and it is the reason a bug costs a bounded amount.

Capacity is contributed by independent operators running attested nodes. Work is assigned by the gateway and settled against receipts, so an operator is paid for units the network can prove were delivered. Operators never see plaintext either — their hardware does, and only inside a frame they cannot inspect.