An AI Agent Cannot Be Audited Like Software. Multikor Built the Evidence Layer That Can.

Refused at load, halted mid-run, proven three hops out through third-party tools -- the agentic enterprise data fabric that generates the record authorization frameworks now demand.

Charlestown, MA, Sept. 22, 2026 (GLOBE NEWSWIRE) -- Governance is now a term of federal contract eligibility, and authorization is moving from a document reviewed every three years to continuous evidence an authorizing official can see in real time. The industry has answered with documentation about agents and called it governance. Multikor.ai, Inc. today detailed the architecture it uses to answer it with evidence instead.

The gap nobody is closing

Every authorization framework in use -- the Risk Management Framework, continuous authorization to operate, software bills of materials, quarterly STIG baselines -- evidences software by inspecting an artifact at rest. What is it made of, what state is it in, which controls are enforced. That works because conventional software is deterministic. Inspect it and you know what it will do.

An agentic system breaks that assumption. Its bill of materials says nothing about its decisions. A passing scan does not establish that it stayed inside its authority. A model card describes the model, not the run. The only evidence that answers the question is behavioral and per-decision: what each agent was permitted to do, what it did, what it was refused, and under whose authority -- produced as the system runs, not assembled afterward.

That is the gap. Multikor produces that record as a property of execution.

How the fabric makes it possible

Multikor is an agentic enterprise data fabric. Agents do not hold knowledge of where data lives, how they authenticate, or what they may touch for a given customer. The fabric resolves all of it at the point of use, against that tenant's actual topology. Because the fabric owns resolution, it is also the only place a request can be refused, recorded and metered. Governance is not a layer bolted beside the agents. It is a consequence of where the boundary sits.

• Enforced at load. Every agent declares its permitted surface, its required output and its evidence obligations. The runtime resolves that declaration against the tenant before the agent starts. Failure to resolve means it does not run. No degraded mode, no override flag.
• Polymorphic resolution. The same declaration binds differently for a healthcare tenant than for a veterinary practice. The contract each is held to does not change. Adding the fortieth agent adds no fortieth place governance could be skipped.
• Human oversight that survives the pause. Approval is bound per call to the tool and its canonically sorted arguments, so it cannot be widened by re-proposing. Circuit-breaker counters restore across the hold. Approvals are a configurable quorum. A stop recorded during a hold cannot be overridden by a later approval.
• Provenance past the perimeter. Every artifact carries an organizational scope path; there is no unscoped run. The ledger records what was requested, what was permitted, what happened, at what latency and under whose authority, with no expiry; and it holds through agentic execution routing outward to MCP tooling and third-party APIs.
• Erasure and audit, together. A redacted value sits in a separate tenant-partitioned store addressable by field. Destroying it removes the value while the ledger still records that it existed, its class, and that it was redacted. Every reveal writes its own audit row.
• Thresholds that mature. A validation boundary warns in bootstrap, soft-rejects in calibration, hard-rejects in production. The platform declines to enforce a limit it has not yet earned confidence in, and hardens as evidence accumulates.

"Most of what is marketed as guardrails is guidance," said Suresh Nelakantam, Co-Founder and Chief Executive Officer. "A guardrail is what the platform enforces when it does not. Health systems and insurers are not asking us for smarter agents. They are asking for enforced limits and refusals on the record, because that is what their compliance teams will sign."

The infrastructure gap the hyperscalers closed halfway

Multikor also published findings on foundation-model billing, measured from its own production workloads as an AWS customer. Cost attribution improved materially in 2026 -- spend now resolves to the calling principal, per tenant, per model. Control did not follow. There remains no native cap on token consumption, no identity policy governing it, and roughly a day of lag before spend is visible. Model pricing spans two orders of magnitude, service tiers move rates 75 percent above and 50 percent below standard, and provisioned throughput is quoted through an account team rather than published.

"Attribution was the easy half, and it arrived," said Leigh Turner, Co-Founder and Chief Technology Officer. "You can now learn precisely who spent what, a day later, with no mechanism that could have stopped it. That is a receipt, not a control. So we stopped instrumenting the token and moved the decision to the only place it can be refused."

Multikor's SLM-first architecture, trademarked and covered by the company's first provisional filing, routes most work to small language models on Multikor-owned infrastructure through its own mixture-of-experts design. Because that routing decision is made once in one place, Multikor prices by agent capability rather than by token. Its own monthly infrastructure spend for production agents across multiple tenants is under $2,700, against a range of roughly $20,000 to $50,000 commonly reported for comparable workloads.

"The measure of an architecture is not how it performs on the day you ship it," said Kimberly Boydston, Co-Founder and Chief Architect. "It is how much of it you have to touch when the requirement changes. A standard that only exists in a document is a suggestion with better formatting -- so we put ours somewhere good intentions cannot reach it."

Built substrate-agnostic

Multikor's control plane -- routing, validation, human oversight, tenant isolation and self-healing -- is the product; compute backends are interchangeable execution targets. As hybrid quantum-classical becomes the consensus deployment model, Multikor is engineered to orchestrate out to those accelerators with the governance and metering chain unchanged. The foundation is owned rather than rented: a four-node GB10 fleet in paired 200-gigabit interconnects, advancing toward high-radix switching, with granted patent protection at the physical interconnect layer covering classical high-radix topologies.

The full technical account including resolution conditions, approval semantics, ledger structure, feedback-loop architecture and the billing findings in detail  is available in Multikor's Technical Capability Brief at [https://multikor.ai/ai-guardra...].

About Multikor: Multikor.ai, Inc. builds a governed agentic enterprise data fabric for regulated industries. The company is a member of the NVIDIA Inception program and an AWS Activate participant, and has filed provisional patent protection covering its acceptance-criteria architecture, SLM-first economics and self-healing adaptation engine. Multikor is a trademark of Multikor.ai, Inc. (C) 2026. All Rights Reserved.

Media Contact: [Anthony Antonuccio] | [press@multikor.ai] [+1 781-254-4001]

##

Attachment

• Multikor.ai Governance Architecture