Pre-execution validation · production agents

Stop agents from
taking the wrong action.

Invariant is the pre-execution control layer for production agents. It blocks bad tool calls by validating every action against shared world state before execution.

Built for teams whose agents write to real systems — CRMs, databases, APIs, workflows. One bad action based on stale or conflicting state is expensive.

Example: what Invariant catches before it runs
edit
Agent calls update_crm_status("deal_492", "closed")
Based on state it read 8 steps ago
hub
Invariant checks shared world state
deal_492 was already closed by a parallel agent 3 steps earlier — and a refund was initiated
block
Action BLOCKED — full reason trace returned
Double-close prevented. Downstream billing workflow protected.

How it works in 10 seconds

Every tool call passes through the same five steps — before it executes.

1
smart_toy

Agent proposes action

update, send, trigger, delete

2
hub

Checks shared state

Every claim, constraint, dependency

3
find_in_page

Contradiction detected

Stale fact, conflict, or missing info

4
verified_user

Verdict returned

VALID RISKY BLOCKED
5
history_edu

Reason trace attached

Full audit trail, every time

POST /actions/validate → {"admissibility": "BLOCKED", "reasons": [{"type": "STALE_STATE", ...}]}
The failure mode

Agents act on what they think is true.
Not what is.

Your agent reads state at step 4. By step 22, that state has changed — another agent updated it, a tool call mutated it, or the fact simply expired. But your agent doesn't know. It proceeds. The write goes through. The downstream workflow breaks.

This isn't a model problem. It's an architecture problem. Production agents need shared world state and a gate that checks it before every action.

close

Stale state causes bad writes

Agent reads fact at step N, acts on it at step N+15. The fact changed. The action is wrong.

close

Conflicting claims go undetected

Two agents write contradictory state. Neither knows. Both proceed. You find out in production.

close

No provenance on why it acted

When something goes wrong, you have logs. You can't answer "what did it believe was true at the time?"

Action Validation Response BLOCKED
{
  "admissibility": "BLOCKED",
  "score": 0.18,
  "reasons": [
    {
      "type": "STALE_STATE",
      "claim": "deal_492.status = open",
      "actual":  "deal_492.status = closed",
      "staleness": 0.91
    },
    {
      "type": "CONSTRAINT_VIOLATION",
      "rule": "no_write_after_refund_initiated",
      "entity": "deal_492"
    }
  ],
  "traceable": true
}

Without Invariant vs. With Invariant

Without
closeAgents act on reconstructed state — whatever the model remembers from context.
closeContradictions pile up silently until something in production breaks.
closeEvery tool call is optimistic. No gate. No block.
closeWhen it fails, you have logs. No reason trace, no provenance.
With Invariant
checkEvery action checked against live, stored world state before it runs.
checkContradictions surface immediately — before a downstream agent acts on them.
checkHigh-risk tool calls are blocked with a reason, not logged after the fact.
checkFull provenance on every decision — which claims, constraints, why BLOCKED.

Three operations. One shared truth.

Instrument once. Validate everywhere.

input
01

Ingest

Push claims and tool outputs from any source via REST or SDK. Invariant builds and maintains the shared world state graph in real time.

POST /claims
POST /observations
sync
02

Reconcile

Contradictions are detected and surfaced as first-class objects. Conflicting claims branch rather than overwrite. Constraints propagate. Coherence score updates continuously.

GET /world/coherence
GET /contradictions
verified_user
03

Validate

Before any agent executes a tool call, call /actions/validate. Get back VALID / RISKY / BLOCKED and exact reasons — before the action runs.

POST /actions/validate
→ VALID | RISKY | BLOCKED

Integrate in
five lines.

Assert claims from tool outputs. Validate actions before execution. Works with any LLM or agent framework — LangChain, CrewAI, AutoGen, or raw API calls.

check
TypeScript and Python SDKs
check
Works alongside any LLM or agent framework
check
Low-latency validation — designed for hot paths
check
Self-host or use Invariant Cloud
crm-agent.js
import { InvariantClient } from 'invariant-sdk';

const inv = new InvariantClient({ baseUrl: 'https://invariant.me' });

// After a tool reads state, assert it
await inv.claims.create({
  entityId: 'deal_492',
  predicate: 'status',
  value: 'open',
  sourceId: 'crm-read-tool'
});

// Before any write, validate first
const result = await inv.actions.validate({
  operation: 'update_crm_status',
  impactedEntityIds: ['deal_492']
});

if (result.validation.admissibility !== 'BLOCKED') {
  await crm.updateDeal('deal_492', { status: 'closed' });
}

Memory, tracing, and orchestration are not enough

The tools you already use don't solve the pre-execution problem.

Vector memory / RAG

Retrieves relevant context. Doesn't track whether that context is still true. Doesn't stop an action when it's based on a stale retrieval.

Tracing (LangSmith, etc.)

Records what happened after the fact. Great for debugging. Doesn't prevent the bad action from running in the first place.

Orchestrators (LangGraph, etc.)

Coordinates which agents run when. Doesn't give agents a shared ground truth or block individual tool calls based on world state.

Invariant is the gate between intent and execution — the layer that checks whether the action is still safe to take right now.

Built for teams running production agents

If your agents can write to real systems, you need a gate before they do.

work

Enterprise & ops workflows

Agents that update CRMs, send escalations, trigger billing workflows, or modify data. Invariant validates every write against current state — so one stale read doesn't corrupt your downstream systems.

account_tree

Multi-agent systems

When multiple agents act in parallel, their world views diverge. Invariant maintains one shared state graph. Conflicts surface immediately — before a downstream agent acts on a contradicted fact.

policy

Compliance & audit

Every validation decision is logged with full provenance — which claims were evaluated, which constraints fired, why the action was allowed or blocked. Export-ready for regulators and incident reviews.

The bigger picture

This is the entry point. The bet is bigger.

Production ops workflows are the wedge. The same pre-execution validation layer that prevents a double-close on a CRM deal is what prevents a robot arm from moving when a sensor reading is stale, or an autonomous vehicle from proceeding when a constraint has been violated.

As agents take higher-consequence actions — in engineering systems, healthcare, defense — the need for a formal, provable gate between intention and execution becomes non-negotiable. Invariant is that infrastructure layer.

Enterprise ops Multi-agent systems Robotics Autonomous vehicles Defense & aerospace Healthcare AI
code Open source · Apache 2.0 · Self-hostable · Star on GitHub arrow_forward

Start validating agent actions.

Instrument in five minutes. Block the first bad action in your staging environment today.

$ npm install invariant-sdk content_copy