Doctrine

The trust layer for artificial intelligence.

Modern AI is fluent, not correct. It speaks with the confidence of an expert and the accountability of a guess. In high-stakes domains, that gap is not an inconvenience - it is a liability.

Boundless Intuition builds the verification layer for AI - formalizing domain rules into machine-checkable form and proving every answer correct before it reaches production.

Bring us your rules Walk through a proof

Get research updates

Plate · fig. I·46.2330° N 6.0557° E

Every input. One proof.

Method

How an AI answer becomes a proof.

We do not grade the model, fine-tune it, or ask it to check itself. We sit a proof engine between the AI and production, and let nothing through that cannot be verified against your rules.

AI output

The answer

"administer 45 mg…"

Formalized domain

The rules

compiled, machine-checkable

Proof engine

Theorem prover

checks claim ⊨ rules

Result

Verified · certified

or refuted, with a witness

AI output

The answer

"administer 45 mg…"

Formalized domain

The rules

compiled, machine-checkable

Proof engine

Theorem prover

checks claim ⊨ rules

Result

Verified · certified

or refuted, with a witness

The model answers

A copilot, agent, or model returns an answer, a decision, or an action. It is fluent and fast - and, on its own, impossible to trust. Today, this is where every system stops.

The domain is formalized - once

Your rules, standards, and policies are compiled into machine-checkable formal objects. This is done a single time, up front. It is the asset that makes every later answer verifiable.

The answer becomes a claim

Each answer is translated into a precise logical statement about what it asserts or does - a claim a theorem prover can reason about, stripped of the ambiguity of natural language.

The prover checks it

A theorem prover checks the claim against the formalized rules. It either proves the answer conforms - or returns a concrete counterexample, a witness to exactly how it fails.

Only proven answers ship

Verified answers proceed, carrying a signed, reproducible certificate. Refuted answers are blocked before they reach production, with the precise reason attached.

The model proposes; the prover disposes. Verification is not another model second-guessing the first - it is mathematics, checking a fluent answer against rules that were written down long before the question was asked.

Coverage

How one proof holds across

18,446,744,073,709,551,616

possible inputs — every value of a single 64-bit parameter. A test suite samples a few thousand. A proof covers all of them, and lets zero escape.

2⁶⁴ · exhaustive, not sampled

Demonstration

Verify an AI answer yourself.

Take an answer from an AI copilot, then change the value and run the check. The verdict is computed live in your browser — push it out of bounds and watch it break. Nothing here is canned.

Want more than a slider? The playground runs real benchmarks against real models — watch an AI answer go wrong and the pipeline catch it.

proof engine

Healthcare

AI answer · AI clinical copilot

Administer methotrexate 20.4 mg this week (34 kg patient).

patient weight34 kg

provable · 10–100 kgcounterexample territory

checked against — dose ≤ 60 mg ceiling · patient ≥ 10 kg (drug label)

$ z3 verify — press verify to run the check

Domains

Wherever the rules are written down.

The same verification pipeline serves any domain governed by written rules - standards, statutes, protocols, or policy. Eight active fronts. One method.

Security & Compliance

Access-control policies, firewall rulesets, and organizational handbooks verified against compliance standards. Conflicts between policy-as-written and policy-as-enforced are surfaced automatically.

Healthcare & Clinical Safety

Dosing protocols, device specifications, and safety envelopes checked against regulatory requirements. Every critical parameter is verified - units, ranges, and boundary conditions included.

Clinical Trials & Protocols

Eligibility criteria, contraindication logic, and dosing rules verified against peer-reviewed guidelines. Ambiguities in the protocol are identified before they affect patient outcomes.

Network & Infrastructure

Firewall rulesets, segmentation policies, and infrastructure configurations verified against PCI-DSS, IEC 62443, and internal security baselines. Changes are proved safe before deployment.

Finance & Risk

Solvency covenants, exposure limits, and margin invariants verified against mandate requirements. Violations are surfaced as concrete counterexamples, not post-hoc audit findings.

Legal & Regulatory

Statutory text, regulatory obligations, and operational rules verified for internal consistency. Every derivation is traceable back to the source provision.

Data Protection & Privacy

Processing records, data-transfer mechanisms, and lawful-basis logic verified against GDPR and regional frameworks. Compliance is proved, not merely asserted.

Export Control & Sanctions

Classification determinations and dual-use assessments verified against current control lists. Every decision carries a machine-checkable derivation.

Value

Cheaper than being wrong.

Compliance is already one of the largest line items in a regulated business - and a single hallucinated answer can turn it into a lawsuit. Verification is a fixed, modest cost set against an open-ended one.

The price of a wrong answer

€20M · 4%

GDPR

The maximum fine is €20 million or 4% of global annual turnover - whichever is greater. A single unlawful data flow, or one hallucinated disclosure of personal data, is enough to trigger it.

SourceArt. 83 GDPR

$2M / yr

HIPAA

Per-violation annual caps on mishandled health data - before the mandatory breach notifications, the OCR investigation, and the class action that follows a leak.

SourceHHS OCR enforcement

Personal

SOX · SEC

Executives personally attest to their controls. A materially wrong AI-generated disclosure is not just a corporate fine - it is individual, criminal-adjacent liability.

Source18 U.S.C. § 1350

Precedent

Litigation

A fabricated citation, an unsafe instruction, a discriminatory decision - once a wrong answer reaches a customer, the cost is discovery, settlement, and case law written against you.

SourceMata v. Avianca

And that is before the standing cost of staying compliant: the reviewers, the outside counsel, the audit consultants, the quarterly evidence-gathering. Formal verification turns that recurring manual tax into a check that runs itself.

Where the cost lands

The cost of a wrong answer

Healthcare

Measured in lives

A wrong dose is not a bug ticket. Verification proves the safety envelope holds for every patient in the label window - before the answer ever reaches a clinician.

Finance

Measured in mandates

A breached covenant or a misfiled disclosure costs fines, restitution, and trust - orders of magnitude beyond the price of proving the trade admissible first.

Security

Measured in breaches

One over-permissioned grant is an incident waiting to happen. Catching it at proof time is free; catching it in a forensic report is not.

The cost of guessing around it

Fewer model calls

Teams paper over unreliability with brute force - retries, self-consistency sampling, ensembles, LLM-as-judge chains - burning tokens to average out errors that never fully vanish. One verified answer replaces a fistful of speculative ones. A proof is deterministic and cacheable; it does not need to be re-rolled.

Errors die before they ship

A mistake is cheap at proof time and ruinous in production. No rollbacks, no post-hoc audits, no war rooms. Verification deletes the expensive tail of a wrong answer - everything that happens after it escapes.

Auditable by construction

Every certified answer arrives with its proof attached. The evidence your auditors ask for is a by-product of running the system, not a quarterly scramble.

And it makes teams faster

Ship at the speed of CI

Manual review is the throttle on every AI feature. When correctness is proved automatically, teams merge and deploy without a compliance queue in the critical path.

Engineers build, not babysit

No brittle test suites chasing edge cases, no hand-tuned guardrail prompts. The rules are formalized once; the prover covers every case, forever.

Audits in minutes, not quarters

Certification becomes a query against signed proofs. Re-certifying after a change is automatic - the evidence regenerates itself.

Automate the high-stakes work

Once answers are provably safe, the decisions that were too risky to hand to AI - the ones that actually move the business - can finally be automated.

A proof runs once and holds forever. Set against the penalties it averts, the tokens spent second-guessing a model, and the audits it pre-empts, the verification layer is not a cost center - it is the cheapest insurance in the stack, and it makes everything downstream of it faster.

Interactive walkthrough

Watch a claim become a theorem.

See how verification works, step by step: a natural-language claim is formalized into a mathematical object, checked against the rules that govern it, and either proved or refuted - with a concrete witness. Scroll to advance. Switch examples to see the same method applied across domains.

dose.smt2

Stage 1 / 7

$ z3 dose.smt2

1; dose.smt2 - pediatric dose safety envelope
2(set-logic QF_LRA)
3 
4(declare-const weight Real)     ; kg
5(declare-const height Real)     ; cm
6(declare-const dose   Real)     ; mg
7 
8(assert (and (>= weight 10) (<= weight 80)))
9(assert (and (>= height 80) (<= height 200)))
10 
11(assert (= dose (* 15 (bsa weight height))))
12 
13; negate the safety property; expect unsat
14(assert (> dose 60.0))
15 
16(check-sat)

unsat

Safety envelope proved. No patient in the label window can receive a dose above 60 mg.

01Stage 1 of 7
The claim
A clinical assistant returns: "administer 45 mg of methotrexate to a 34 kg patient." The sentence sounds right - but sounding right is not the same as being safe. Verification starts here.
02Stage 2 of 7
Choose a logic
We ask a theorem prover to reason in linear real arithmetic - a well-understood fragment of mathematics guaranteed to give a definite answer.
03Stage 3 of 7
Name the unknowns
Weight, height, and dose become real-valued variables. The prover will consider every possible assignment of numbers to them.
04Stage 4 of 7
Encode the label
The FDA monograph specifies the patient range the drug is licensed for: 10–80 kg, 80–200 cm. These become constraints the prover enforces across every possible patient.
05Stage 5 of 7
Encode the formula
The label also gives the dosing formula: 15 mg per unit of body surface area. That equation becomes another assertion.
06Stage 6 of 7
Negate the property
We do not ask the prover to confirm the property. We ask it to find a counterexample - any patient who could receive more than 60 mg.
07Stage 7 of 7
The verdict
The prover reports unsat: no such patient exists within the label window. The safety envelope is not a policy or a hope - it is a theorem, machine-checked and independently verifiable.