A Runtime Model for
AI Agent Behavior
Observation and Governance.
Observe AI Agent behavior at runtime through
Plan, Execution, and Rationale.
Validate behavior consistency before
governance decisions are trusted.
Implemented by Custos Runtime.
What is PER?
PER is a runtime model for observing AI Agent behavior through Plan, Execution, and Rationale. By collecting all three at runtime, AI Agent behavior becomes explainable, verifiable, and governable.
Plan
What the agent intends to do — a natural language statement of the intended action, produced before execution.
Execution
What the agent actually does — the concrete action submitted to a database, API, tool, or shell at runtime.
Rationale
Why the agent claims it is doing it — the business justification that explains the intent behind the execution.
PER consistency means Plan, Execution, and Rationale are semantically aligned. Policy compliance means the action conforms to organizational governance rules. Both conditions must hold for AI Agent behavior to be trusted.
Why PER?
Traditional guardrails focus on permissions.
Existing authorization systems evaluate who can access what — users, roles, resources, and actions. They answer "is this allowed?" but not "is this what the agent actually intended?"
PER focuses on observing actual runtime behavior.
By collecting Plan, Execution, and Rationale at runtime, AI Agent behavior becomes observable, explainable, and verifiable — not just permitted or blocked.
Behavior cannot be trusted unless Plan, Execution, and Rationale remain consistent.
When any of the three elements diverge in meaning, the agent's behavior becomes unpredictable — even when individual components appear valid.
SELECT COUNT(*) FROM film WHERE rating='PG' The execution was policy-compliant — but it didn't match what the agent said it would do. PER detected this inconsistency before the action was trusted.
What a Runtime Card Looks Like
Every AI Agent action observed by Custos produces a Runtime Card — a human-readable record of what the agent planned, executed, and justified.
Retrieve the top 10 actors from the actor table.
SELECT actor_id, first_name, last_name
FROM actor
LIMIT 10;The user wants a quick overview of the actors registered in the database. Selecting only the necessary columns and limiting to 10 rows serves the request efficiently without over-fetching data.
Runtime Cards provide a complete behavioral record for every AI Agent action — readable by both humans and automated systems.
- P Plan is recorded before execution — capturing intent before the action happens.
- E Execution is the actual SQL, API call, or command submitted at runtime.
- R Rationale explains why the agent chose this execution — providing the business justification.
Read the Discovery Paper
Learn how PER was discovered through repeated runtime observation, validated against real AI Agent behavior, and implemented in Custos Runtime.
The paper covers the evolution from Intent → Decision → PER, the PER Consistency model, and runtime evidence from the Custos benchmark.
PER explains the model. Custos implements the runtime.
PER: A Runtime Model for AI Agent Behavior Observation and Governance
Observation. Consistency. Governance.
Runtime Observation
Observe AI Agent behavior at runtime. Plan, Execution, and Rationale are collected at the moment of action.
Behavior Consistency
Validate PER consistency before trusting any action. Inconsistent behavior is detected and blocked.
Policy Compliance
Evaluate policy compliance against organizational governance rules. Allow or deny before execution.
Evidence & Governance
Generate Runtime Cards for every observed action. Inspect evidence and audit the full behavioral record.
How Custos Runtime Works
Custos intercepts AI Agent actions at runtime, collects PER, validates behavior consistency, enforces policy compliance, and generates Runtime Evidence — before any action is executed.
Runtime Observation
Custos intercepts AI Agent actions at runtime and collects Plan, Execution, and Rationale — the three PER elements.
Plan: "Retrieve top 10 actors."
Execution: SELECT actor_id … FROM actor LIMIT 10;
Rationale: "User wants a quick overview of registered actors."
Behavior Consistency
Custos validates that Plan, Execution, and Rationale are semantically consistent with each other.
Plan says "list movies" — Execution returns COUNT(*). Consistency FAILED → action blocked.
Policy Compliance
Custos evaluates the observed behavior against organizational governance policies defined in natural language.
FIN-1: Finance agents may access payroll data only for reporting purposes.
Evidence & Decision
A Runtime Card is generated. The action is allowed or denied before execution — with a complete behavioral audit trail.
DENY — Customer PII access violates Agent Policy §3. Runtime Card generated. Evidence preserved.
PER-First Runtime Design
Traditional guardrails filter inputs and outputs. Custos observes AI Agent behavior at the moment of action — before any execution reaches the target system.
By collecting Plan, Execution, and Rationale at runtime, Custos validates behavioral consistency and policy compliance, then generates a Runtime Card as verifiable evidence for every action.
Python & Node.js
supported SDK
Envoy WASM Filter-based
traffic flow control
Protects Postgres,
MySQL, APIs & more
Manage and monitor
CENTRAL operations
Policy reasoning with
public or private LLMs
SDK Documentation
The SDK documentation is currently being updated to support the PER Runtime Model introduced in the Discovery Paper.
Updated documentation and integration examples will be available in an upcoming release.
Governance for AI Agents
Custos allows organizations to govern AI agents using natural language policies, evaluated by LLM-powered policy reasoning and enforced at runtime.
AI agents are evolving beyond simple chat interfaces. They can now query databases, call APIs, execute workflows, and perform real business operations autonomously.
As organizations adopt AI agents, critical questions emerge:
- What is the AI trying to do?
- Does the plan comply with human-readable policies?
- Should this action be allowed before execution?
- Can every decision and action be audited later?
Custos was created to answer these questions.
Unlike traditional IAM systems or policy engines, Custos evaluates AI agent plans against human-readable governance policies.
Organizations can define policies in natural language, while Custos uses LLM-powered policy reasoning to determine whether an action should be allowed.
Positioned between AI agents and enterprise systems, Custos validates intent, enforces policies at runtime, and creates a complete audit trail for every AI-driven action.
Our vision is to become the trust layer for the AI era, enabling organizations to deploy AI agents securely, governably, and with confidence.
Founder & Vision
Custos was founded by a software architect with more than 20 years of experience in enterprise software, cybersecurity, cloud infrastructure, and distributed systems.
His background includes delivering security-sensitive projects for financial institutions, government agencies, and enterprise customers where governance, compliance, and auditability are essential.
He also brings extensive experience in AI model training, inference serving, and AI platform engineering, providing firsthand insight into the challenges of deploying autonomous AI systems safely at scale.
Custos was founded with a simple mission: to make AI actions secure, governed, and auditable by default.
Building the Future of AI Governance
Our journey toward making AI actions secure, governed, and auditable across enterprise environments.