Runback
The standard

Verifiable Agent Execution.

One question decides whether an enterprise can deploy an AI agent: can you reproduce what it did, prove it cryptographically, and block any unverified change — in your own perimeter, across any model? That standard has a name, and Runback is built to it.

The six properties.

Deterministic replay

Re-run any decision exactly — offline, byte-exact, no model calls.

Re-executable audit

A signed record whose digest the run must reproduce. Verify it, don't just read it.

Language-agnostic capture

Any agent, any language, one base-URL change. No SDK, no support.

Release-gated

Block any agent change that doesn't reproduce the audited baseline, in CI.

In your perimeter

Self-host. Data and prompts never leave your environment.

Model-neutral

Governs whatever you run — GPT, Claude, Gemini, or your own.

Captured wherever your agent runs — in-process, at the network gateway, or in the kernel syscalls beneath any native binary, in any language.

Where everyone stands

We don't compete on models. We own the layer above them.

The model labs win on models — and ship evals and tracing. None ship the verification layer, and they're structurally disincentivized to: it commoditizes the model and keeps your data out of their cloud.

Runback
OpenAI
Anthropic
Google
Foundation models
—
✓
✓
✓
Evals & tracing dashboards
✓
✓
partial
✓
Deterministic replay — offline, byte-exact
✓
✗
✗
✗
Cryptographically-verifiable, re-executable audit
✓
✗
✗
✗
Language-agnostic capture (no SDK)
✓
✗
✗
✗
CI gate — block unverified agent change
✓
✗
✗
✗
Self-host · data in your perimeter
✓
✗
✗
partial
Model-neutral — governs all of them
✓
✗
✗
✗

Honest by design — the labs get every ✓ they've earned. The bottom rows are the standard, and only one column holds them.

The substrate

Determinism, proven at every layer.

One recording, captured wherever an agent runs — and reproduced exactly, from the language runtime down to the retired instruction. Every layer is verified on every commit.

  1. 01In-processTool calls, clock, randomness, and network — captured in the agent's own runtime.✓
  2. 02Network gatewayEvery external call from any agent, in any language — one base-URL change, no SDK.✓
  3. 03Native libcAny binary: the clock, the RNG, and the kernel syscalls beneath them.✓
  4. 04Syscall (ptrace)getrandom and clock_gettime intercepted at the kernel boundary — even static binaries.✓
  5. 05SchedulerThreads serialized onto one timeline — racy interleavings made reproducible.✓
  6. 06Instruction-preciseReproduce even a nondeterministic concurrency bug — pinned to the exact instruction, every time.✓

Every layer runs green in public CI on every commit — see the proof ↗

Hold your agents to the standard.

See it work on a real run, or read how the verification is built.

See it work →How it's built