AFFIANT

Something is being sworn.

Sworn provenance for every AI write.

Affiant is a deterministic evidence layer for .NET: field-level provenance, sworn affidavits, and a human review gate between your LLM and your database.

Get started See it live

The problem

AI agents now write to systems of record — closing work orders, adjusting inventory, amending employee files. They do it quickly, and they do it unwitnessed. When the record is later found wrong, nothing can tell you which field the model was told and which it invented.

The evidence card

A write proposal, on the record.

Docket · Evidence Card

Work order closeout — affidavit

quantityUsed: 4
partNumber: PN-4411-A
laborHours: 3.5
closeoutNotes: —

This reviewer UI holds Approve while a required field is blank. The framework flags; the host decides.

Write tools never write. The proposal waits, on the record, for a human.

Every field on an affidavit carries a provenance tag — a sworn statement of where the value came from. A value the user gave you and a value the model guessed are never allowed to look the same.

The Empty tag is not an error. It is the framework refusing to pretend. A required field left Empty holds back a standing order — that verdict degrades to a reviewer’s confirmation — and drags the write’s aggregate confidence to 0. What the framework never does is take Approve away from the person looking at the card.

The live demos

See a real one get sworn.

Two host applications built on Affiant run in public: an aircraft-maintenance desk and a small HR department. Ask either agent to change something and the proposal comes back as an Evidence Card — every field wearing its provenance — and waits for you. Nothing is written until the review flow approves it: you, on the card, or a standing order the host wrote in advance.

Sign in with any email address — a one-time code is sent to it. No account, no password; you stay signed in for 24 hours.
Five messages a day, per person, per demo.
Shared, synthetic data, in a container that sleeps after fifteen idle minutes and is destroyed outright nightly at 00:00 UTC — the disk is ephemeral either way, so the next request after one of those starts a fresh, reseeded app.
Seats are finite: a first sign-in can be refused — the demos share a fixed seat cap, and each admits only so many new visitors a day, resetting at 00:00 UTC.
After a quiet spell, the first visit takes a few seconds to wake.

Live · meridian.affiant.dev

Meridian

Aircraft maintenance — a fleet of ten, its work orders, a parts inventory. The agent runs on the Microsoft Agent Framework.

Show me all AOG aircraftA read tool. A straight answer.
Create an AOG work order for the left engine on WZ-BRNThe Evidence Card moment. Approve it, reject it, or amend a field first.
Guide me through creating a work orderRule 6, live: the agent guides your UI through a registry, never the DOM.

Open Meridian →How it works

Live · hrportal.affiant.dev

HR Portal

A small HR department — an employee directory, leave requests, expense reports. The agent talks to Microsoft.Extensions.AI directly.

Find employee Priya NairA read tool. Its answer is the employee the rest of the conversation acts on.
Submit an expense report of 120 dollars for a client lunch for Priya NairThe Evidence Card moment. Approve it, reject it, or amend a field first.
Request 1 day of sick leave for Priya Nair tomorrowAffiant.Policies, live: a standing order approves it on the spot and the write lands without a confirmation. A card still arrives, and it looks like any other — the framework marks it as needing no confirmation; this demo does not display that.

Open HR Portal →How it works

The card above is an illustration. These two are real. The Meridian shot was captured on 2026-08-26, against the fleet the demo seeded then; the registrations were replaced later that day, so the aircraft it shows is not in the demo’s fleet today — the prompt above names one that is.

Meridian runs on Affiant.Abstractions, Affiant.Core, Affiant.AgentFramework, Affiant.SemanticKernel, Affiant.Docket, Affiant.EntityFramework, Affiant.Policies and Affiant.Transport.SignalR — Affiant.EntityFramework there for the in-memory chat-session store that ships in it rather than for a docket, and Affiant.SemanticKernel for the provider-configuration type its chat clients are built from rather than for a second interception seam. HR Portal runs on Affiant.Abstractions, Affiant.Core, Affiant.Extensions.AI, Affiant.Docket, Affiant.EntityFramework, Affiant.Policies and Affiant.Transport.SignalR. Both use Gemini 2.5 Flash. The apps themselves are private first-party hosts; everything they run on is Apache-2.0.

The seven normative rules

Non-negotiable, by design.

1
One system prompt per agent, immutable after initialization.
Framework code never mutates the system prompt at runtime.
2
Dual-audience tool returns.
Every tool return is readable by both the LLM and the UI.
3
Write tools never write.
Write-intent tools produce WriteProposal envelopes; the domain write happens only after the review flow approves — a reviewer, or a standing order a human authored in advance.
4
Filters over prompts for determinism.
Context extraction, task inference, and review gating live in filters — never in prompt text.
5
Graceful degradation on provider failure.
A provider failure degrades the turn instead of ending it — fewer inferred fields, lower confidence. Only a cancellation is rethrown.
6
data-guide contracts are UI-layer registrations.
The LLM discovers guidable elements through a route registry, never by inspecting the DOM.
7
Every Affidavit field carries provenance, no exceptions.
If a proposed field’s origin is unknown, tag it Empty — never omit. A field the operation does not propose stays off the list entirely.

Read the rules in full →

The provenance ladder

Seven grades of trust.

Every value is tagged with exactly one source in force. They descend from what was sworn to what was never established.

01UserStatedThe user said it, in so many words.
02ExternalRead from an authoritative system of record.
03ComputedDerived deterministically from trusted inputs.
04ConversationDrawn from earlier in the dialogue.
05InferredThe model’s best guess, sworn as exactly that.
06DefaultA fallback value no one actually supplied.
07EmptyProvenance unknown, marked rather than left out. It counts as 0.

Ten packages, one DAG

Small, layered, and honest about it.

Abstractions sits at the root. Core builds on it. The three interception bridges and the four adapters build on Core and never reference each other; only the compliance harness, a layer above them, reaches across — toDocket and Policies.

Affiant.Abstractions

Domain-agnostic primitives and every backend-neutral contract a host implements. Zero Affiant dependencies — the root of the DAG.

Affiant.Core

Concrete services: the Context Fabric, the Review Gate, telemetry.

Affiant.SemanticKernel

The Semantic Kernel bridge — runs the same neutral pipeline at SK’s two filter positions.

Affiant.AgentFramework

The Microsoft Agent Framework bridge, over the same neutral pipeline.

Affiant.Extensions.AI

The Microsoft.Extensions.AI bridge — no agent framework required.

Affiant.Docket

The review queue’s backend-neutral half: in-memory store and the expiry sweep.

Affiant.EntityFramework

Chat-session stores — in-memory, SQLite or PostgreSQL — and the SQL-backed Docket stores.

Affiant.Policies

Approval policies deciding what needs a reviewer’s confirmation — and what a standing order may approve without one.

Affiant.Transport.SignalR

Streams Evidence Cards and agent output to the host UI.

Affiant.Testing.ComplianceHarness

Proves your provenance is substantive, not merely shaped.

See the full package reference →

The honest boundary

Affiant intercepts tool calls invoked locally in your host process — including locally-invoked MCP tools. Hosted, server-side tool execution that runs outside your process is beyond its reach, and Affiant does not claim otherwise.It swears to the field; it does not sign or hash-chain the log — and approval lives in the Docket, not in the conversation.

Where the boundary lies →