cd /news/ai-safety/agentic-ai-drops-digits-this-library… · home › topics › ai-safety › article
[ARTICLE · art-97124] src=github.com ↗ pub= topic=ai-safety verified=true sentiment=· neutral

Agentic AI drops digits, This library catches them before it runs in fintech

PrismManifest 0.3.4, an open-source Python library from insightitsGit, provides a zero-trust gate that verifies Ed25519-signed ParameterManifests before allowing probabilistic AI outputs (LLMs, OCR) to pass dollar amounts into deterministic financial compute DAGs, preventing digit drops and unauthorized money values in fintech engines. The library, available via pip install prismmanifest, routes outcomes as ACCEPT, ACCEPT_PENDING_HUMAN, or REJECT, and supports optional CUDA and cloud KMS integrations.

read6 min views1 publishedAug 14, 2026
Agentic AI drops digits, This library catches them before it runs in fintech
Image: Michielbdejong (auto-discovered)

Zero-trust tool-argument gate for deterministic AI tool execution.

(Formerly ParamGate — same design; package prismmanifest, CLI prismmanifest-gate.)

PrismManifest sits between probabilistic extractors (LLMs, OCR, table parsers) and deterministic Group 3 compute DAGs. Unverified money values never enter the DAG. Only an Ed25519-signed ParameterManifest

that clears the Group 3 boundary is allowed through.

Deterministic Engine + Unverified Probabilistic Input = Deterministic Wrong Answer

PyPI name | prismmanifest |

Version0.3.4

PythonLicenseRepositoryinsightitsGit/PrismManifest** Discussions**Q&A and design** Docs (Markdown)**docs/

Docs (PDF)docs/pdf/

Usage guidedocs/USAGE_FOR_ENGINEERS_AND_ARCHITECTS.md

SecuritySECURITY.md

Keywords: tool argument gate, ParameterManifest, digit drop prevention, zero-trust LLM tool args, deterministic DAG boundary, OCR money field authorization, PrismManifest

Probabilistic systems (LLMs, OCR) are excellent at proposing where a number is. They must not be trusted to authorize the dollar amount that enters a tax engine, ledger, or underwriting model. PrismManifest is that authorization boundary.

pip install prismmanifest

With optional extras:

pip install "prismmanifest[dev]"
pip install "prismmanifest[cuda]"          # NVIDIA GPU + Numba
pip install "prismmanifest[kms-azure]"     # Azure Key Vault envelope keys
pip install "prismmanifest[kms-aws]"       # AWS KMS envelope (optional)

From source (editable):

git clone https://github.com/insightitsGit/PrismManifest.git
cd PrismManifest
python -m pip install -e ".[dev]"
python -m pytest -q

CLI after install: prismmanifest-gate

.

Extra Purpose
dev
pytest, coverage, grpcio-tools
docs
markdown + fpdf2 (PDF pack builder)
cuda
Numba + CUDA 12 wheels (GPU required)
kms-azure / kms
Azure Key Vault wrap (preferred cloud KMS)
kms-aws
boto3 AWS KMS-envelope
  • Treat LLMs / OCR / parsers as untrusted. - Put PrismManifest after extraction andbefore any calculator, underwriting, or ledger tool that consumes dollar amounts. - Route outcomes: ACCEPT

→ run DAG ·ACCEPT_PENDING_HUMAN

→ review ·REJECT

→ stop. - Never let model-generated money text be the tool argument — only evidence-bound, signed manifests.

LLM / OCR  →  PrismManifest  →  signed ParameterManifest  →  Group 3 DAG

Extra LLM benches are optional evidence. They do not change the core gate design. Finding real customer documents matters more for production claims than multi-model FA studies.

Full write-up: Usage for Engineers & AI Architects (and PDF: docs/pdf/01_USAGE_FOR_ENGINEERS_AND_ARCHITECTS.pdf

).

from prismmanifest import KeyRing, PrismManifestPipeline, enforce_group3_boundary, GateDecision
from prismmanifest.router import DocumentPackage, IntentRouter
from prismmanifest.integrations import demo_capital_gains_dag

keyring = KeyRing.generate(key_id="local-dev-ed25519")

package = DocumentPackage(
    doc_id="1040.txt",
    pages=[
        "Form 1040 Tax Year 2024\n"
        "Line 1 Gross income: $470,000.00\n"
        "Line 11 Adjusted gross income: $450,000.00\n"
    ],
    form_type="IRS_FORM_1040",
    tax_year=2024,
)

routed = IntentRouter().run(package)

pipeline = PrismManifestPipeline(keyring)
result = pipeline.run_on_evidence(
    evidence=routed.evidence,
    extraction=routed.extraction,
)

gate = enforce_group3_boundary(
    result.manifest,
    public_keys=keyring,
    expected_dag_id="capital_gains_v3",
)
if gate.decision is GateDecision.ACCEPT:
    receipt = demo_capital_gains_dag(gate.manifest)
    print(receipt)
else:
    print(gate.decision, gate.message)
python
from prismmanifest.audit import EscalationQueue
from prismmanifest import PrismManifestPipeline, KeyRing

keyring = KeyRing.generate()
queue = EscalationQueue(".escalation")
pipeline = PrismManifestPipeline(keyring, escalation_queue=queue)
python
from prismmanifest import parameter_gated, KeyRing

keyring = KeyRing.load(".keys")

@parameter_gated(public_keys=keyring, expected_dag_id="capital_gains_v3")
def run_dag(*, manifest):
    return manifest.fields[0].value_fixed_micro

Production trust must still go through enforce_group3_boundary

/ gRPC / C++ / in-process prismmanifest_c

.

from prismmanifest.binary_codec import encode_manifest
from prismmanifest.gate import enforce_group3_boundary

buf = encode_manifest(signed_manifest)
result = enforce_group3_boundary(buf, public_keys=keyring, expected_dag_id="capital_gains_v3")

Schema: schemas/prismmanifest.fbs.

  • Skip enforce_group3_boundary

because the pipeline “looked good” - Feed LLM-printed $

strings straight into the DAG - Treat @parameter_gated

alone as the boundary - Market cuda_sim

/ SKIP as CUDA-validated

Ingest evidence with dual-OCR consensus (PDF text + layout re-tokenizer; optional Tesseract).Ground claims to verbatim spans and form anchors (no generative money values).DecidePASS

/PASS_WITH_HUMAN

/REFUSE

via quorum, OCR floor (≥ 0.98), and plausibility.Sign aParameterManifest

(Ed25519) and optionally escalate human review.Enforce the Group 3 boundary before any DAG runs — Python, gRPC, C++ FlatBuffer, or in-process DLL.

FinancePackBench and FinancePackBench-G4 provide synthetic SLA / adversarial suites.

Status Meaning
PASS
Span-grounded, plausibility OK, no disagreement, OCR ≥ 0.98, anchors OK
PASS_WITH_HUMAN
Immaterial disagreement (≤ $1k), low OCR, or anchors unverified
REFUSE
Not grounded, plausibility failure, or material disagreement (> $1k)
Decision When
ACCEPT
PASS , or cleared PASS_WITH_HUMAN with valid human approval token
ACCEPT_PENDING_HUMAN
PASS_WITH_HUMAN awaiting review
REJECT
REFUSE , bad/missing clearance, or attestation/freshness/replay/dag failure

Attestation, freshness (signed_at_unix

skew, default 300s), and replay (ReplayGuard

) failures raise GateError

.

prismmanifest-gate gen-keys --out .keys --key-id local-dev-ed25519
prismmanifest-gate gen-hsm-key --out .hsm --key-id prod-ed25519
prismmanifest-gate gen-kms-key --out .kms --mode local --key-id kms-dev

prismmanifest-gate sign --keys .keys --manifest manifest.json --out signed.json
prismmanifest-gate sign --keys .keys --manifest manifest.json --out signed.fbs --flatbuffer
prismmanifest-gate verify --keys .keys --manifest signed.json --dag-id capital_gains_v3

prismmanifest-gate bench --packages 500
prismmanifest-gate bench --require-cuda --packages 40
prismmanifest-gate bench-manifest-parity --packages 500 --require-cuda
prismmanifest-gate bench-perf --out reports/perf
prismmanifest-gate bench-customer-pdf --corpus .corpus/customer --seed-synthetic
prismmanifest-gate compliance --out reports/compliance
prismmanifest-gate pilot-pack --out reports/pilot_pack
prismmanifest-gate g4-suite --out reports/g4 --fuzz 200

prismmanifest-gate audit-replay --store .audit --receipt <id> --keys .keys
prismmanifest-gate escalation-list --queue .escalation
prismmanifest-gate review-ui --queue .escalation --keys .keys --bind 127.0.0.1:8766

Proto: proto/prismmanifest_gate.proto

Service: prismmanifest.v1.Group3Gate

— VerifyManifest

, ExecuteDag

from prismmanifest.attestation import KeyRing
from prismmanifest.grpc_servicer import serve

serve(KeyRing.load(".keys"), bind="[::]:50051")
powershell -File scripts/build_cpp_gate.ps1
prismmanifest_gate_enforce signed.fbs public.pem <key_id> capital_gains_v3

Python can call the shared library without process spawn:

from prismmanifest.cpp_bridge import enforce_fb, bridge_status
print(bridge_status())  # inprocess_available when PRISMMANIFEST_C_DLL / build present

“Ops packaging” = how you run the gate in a service (not the algorithm):

  • Keys (local / software-HSM / Azure KV)
  • RBAC, timeouts, idempotency, metrics ( prismmanifest.ops

) - Audit store + human review UI

  • Optional C++ / CUDA beside the Python package

See docs/handoff/PILOT_DEPLOY.md.

Doc Role

PRISMMANIFEST_SYSTEM_DESIGN.mdauthority)PRISMMANIFEST_IMPLEMENTATION_PLAN.mdPRISMMANIFEST_MASTER_SPECIFICATION.mdFINANCEPACKBENCH_G4_ADVERSARIAL_SUITE.mdFINANCEPACKBENCH_PROMPT_INJECTION_SEMANTICS.mdPASS

docs/pdf/Regenerate PDFs:

pip install "prismmanifest[docs]"   # or: pip install markdown fpdf2
python scripts/build_docs_pdf.py
prismmanifest/           Python package
cpp/gate/            C++ canonicalize + FlatBuffer enforce + prismmanifest_c
cuda/kernels/        Experimental .cu kernels
schemas/             prismmanifest.fbs
proto/               gRPC Group3Gate
tests/               pytest
docs/                Specs + usage + PDF output
scripts/             proto, C++ build, CUDA shim, PDF builder
reports/             Generated proof artifacts (not required for pip install)
Label Meaning
Pilot OSS
Synthetic + adversarial FA=0 under test; Py/C++/CUDA decision parity; in-process C++ path
Production claim
Requires your live customer fax/scanned corpus to pass the same FA/SLA bar

Also:

Security boundary=enforce_group3_boundary

/ gRPC / C++ /prismmanifest_c

— not@parameter_gated

alone.CUDA: real parity needs GPU + Numba;cuda_sim

is CI self-check only.HSM:gen-hsm-key

is software encrypted-at-rest, not PKCS#11 hardware.Prompt injection: PrismManifest is an execution trust gate — see the injection semantics doc before claiming “injection defense.”

Publishing notes: docs/PUBLISHING.md.

Channel Use for

IssuesSECURITY.mdCONTRIBUTING.mdApache License 2.0 — see LICENSE.

source & further reading
github.com — original article Open-world perception: safe handling of unknown road objects via a taxonomy I built an efficient graph-search plugin for Claude Code skills Show HN: Hexis, open-source Claude Skills management
── more in #ai-safety 4 stories · sorted by recency
── more on @prismmanifest 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/agentic-ai-drops-dig…] indexed:0 read:6min 2026-08-14 · —