Rabit — See the consequence before the action

The problem

Permission isn't safety. Once it's done, it's done.

An agent can be perfectly authorized to delete a customer, wire a payment, or make a repo public — and still do it at the wrong moment, tricked by a poisoned input or simply wrong. The action fires in milliseconds, before anyone reviews it. The one that hurts you is the one no rule anticipated.

of leaders report agent-driven incidents — despite feeling "covered."

Source: State of AI Agent Security 2026 — survey of 900+ executives & practitioners.

Guardrails & classifiers

Pattern-match the past

They match an action's text against known-bad rules — so they only catch what someone already thought to write down. The novel case walks straight through.

✕ blind to what it hasn't seen

The model's own reasoning

The fooled brain, judging itself

The same model the attacker just hijacked decides whether it's safe. It produces words, not predictions of what will actually happen — and it's confident when it's wrong.

✕ words, not guarantees

Monitoring & observability

Hindsight, after the damage

It records what the action did — after it happened. A camera, not a brake. By the time you see the trace, the data has already left the building.

✕ no prevention for irreversible acts

Every layer today checks what an action looks like. None of them check what it will do.

How Rabit works

We reason about what an action will do — not what it looks like.

Consequence-aware by design — a learned world model that predicts an action's effect before it runs.

Predict the resulting state.

A learned world model reads the live state and the action the agent proposes, and predicts the state it would produce — before it runs. Reversible or not, and how far it reaches, fall straight out.

world model core · predictor v1 in build

Input

current state + proposed action · DELETE /customers/4471

↓

f(state, action)

predicts the resulting state · advisory

↓

reversibilityIRREVERSIBLE

blast radius3 open invoices · $8,400 ARR

confidence0.93 → HOLD

Route on the prediction.

A fixed rule acts on that prediction: irreversible or high-impact waits for a human, catastrophic is stopped, and the routine 95% flows untouched.

The prediction is advisory — it decides what a human reviews. Hard blocking stays deterministic, and never fails open.

ALLOWpost_internal_note — flows, no friction

HOLDdelete_customer — irreversible, waits for a human

BLOCKexport_db — unknown host, connection never opens

It teaches itself. It compounds.

It learns from consequences it generates for itself: rehearse an action in a sandbox, diff the world before and after — that diff is a free, ground-truth label. Sharper with every action; a rulebook isn't.

Trust envelope: code, files, databases and git sandbox faithfully — trusted prediction. Money and external sends can't — those default to a human.

01Sandbox rehearsal — run the proposed action in a secure, isolated copy of the system.

02State diffing — compare before and after; the diff is the ground-truth consequence.

03Model update — the world model's dynamics core learns, with zero human labels.

The moat is the data: a consequence-label stream from sandbox simulations that compounds with every action Rabit sees.

Our vision

AI is moving from words, to actions, to the physical world.

Every step in that arc needs a layer that understands consequences — one that knows what an action will do before it happens. We're building that layer: the control plane between an agent's intent and its effect on the world.

Software · today

Financial services, insurance, customer support, code & DevOps — agents already writing to production.

Physical · next

Mobility, robotics, industrial systems, medical devices — where a wrong action can't be undone at all.

The same primitive — predict the consequence, before the action — governs a database write today and a robot's motion tomorrow.

See the consequence before the action.