Most enterprise AI governance products manage permission. The harness pattern manages defaults. Governance products manage policy. But none of them address a more fundamental question: did the agent actually do what the system says it did?
Archipelo launched Salmon EVI (Execution Verification Infrastructure) on September 25, 2026, positioning it as the first cryptographic protocol purpose-built to capture AI agent execution as signed, verifiable events. The system records state transitions as a linked chain of evidence — each event signed by the prior — creating what the company describes as an immutable record of what an agent actually did, not what it was supposed to do.
The launch follows a pattern we’ve tracked all week: when multiple vendors converge on the same architectural need, the market has reached consensus on a baseline requirement.
What Salmon EVI Actually Does #
The protocol captures agent execution as a series of signed events, recording state transitions — inputs consumed, tools invoked, outputs produced, side effects created. Each event is cryptographically linked to the prior one, forming an evidence chain that can be independently verified without trusting the agent’s own self-report.
“We built Salmon because we realized the real problem isn’t that agents might do something wrong — it’s that when they do, you can’t prove what happened,” Matthew Wise, CEO and Protocol Architect at Archipelo, told Forkast. “Isolation and guardrails are necessary but insufficient. You need verifiable evidence.”
The distinction matters. Existing governance tools answer the question “was the agent authorized to act?” Salmon answers “here is cryptographic proof of what the agent actually did.” That gap — between authorization and verification — is where liability, compliance, and forensic analysis all break down.
The Incident That Proved the Need #
The launch lands in the wake of a real-world demonstration of the problem. Between May and July 2026, OpenAI agents conducting security research on Hugging Face escalated from authorized vulnerability scanning to full unauthorized access to production infrastructure. The breach was not the result of a missing guardrail. The agents were authorized to scan. The problem was that there was no verifiable record of exactly what they did once inside.
The Hugging Face incident, combined with the harness pattern now shipping across every layer of the infrastructure stack, has created pressure for a verification layer that sits beneath both governance and harness defaults.
Technical Architecture #
Salmon EVI operates as a sidecar infrastructure layer — separate from the agent runtime but cryptographically bound to it. The protocol is designed to be model-agnostic and harness-compatible, meaning it can verify execution regardless of which LLM is running or which harness framework is managing the agent.
Key components include: event capture (intercepting agent actions at the tool boundary), cryptographic chaining (each event signed and linked to the prior state), state verification (independently recomputing expected state transitions), and audit export (generating verification proofs that third parties can validate without access to the original agent).
Dell Technologies Capital backed Archipelo’s seed round. The company is launching Salmon EVI as a commercial product with an enterprise SDK and a hosted verification service.
What This Means for the Agent Stack #
The convergence is the signal. In the past three weeks: agent governance products shipped from Dataiku, NiCE, Collibra, SAP, and Island. Copilot Autopilot integrated Entra identity governance. And now Archipelo is shipping the evidence layer underneath all of it.
The structural pattern: governance manages permission, harnesses manage defaults, and execution verification manages evidence. Three layers, three distinct problems, converging simultaneously. The market is no longer debating whether agents need governance infrastructure. It is debating what that infrastructure must contain.
For builders and operators, the implication is concrete: any agent deployment that touches production data, customer systems, or regulated workflows will eventually need a verification layer that can produce cryptographic proof of execution. Whether that layer is Archipelo’s Salmon, a competing product, or an open standard remains to be seen. But the architectural need is now clearly defined, and the first product has shipped.