What the institute has built, how it is measured, and how to take part
Since 24 April 2026 the institute has been running the MITR gate. It sits between an AI agent and the systems the agent works on, and lets an action through (deleting data, deploying code, sending a message outside) only after a solver has proven that the action does not break a rule. Every decision leaves a receipt, and an outsider can verify the chain of receipts with their own tools, without having to trust us.
There is no revenue and no external customer yet. Below is what exactly has been built, which figures support it, where each figure can be checked, and the ways to take part.
The figures on this page were taken from the gate’s server on 24–25 October 2026; each comes with its date and a way to check it. Commands for checking them yourself are in “How to check it yourself”.
Who we are
ANO Scientific Research Institute of System Synthesis, Moscow, a non-profit research organization (OGRN 1267700083617). The institute studies how to check the actions of AI agents before they run, a field we call IS 3.0. Scientific director: Alexander Fischuk, a lawyer (member of the Russian Bar) with more than twenty years in audit, corporate finance and insolvency practice.
The problem
An agent acts on behalf of an organization, and the organization answers for its mistakes: a payment to the wrong recipient, a deleted database, an e-mail carrying personal data. Firewalls and antivirus do not see such an agent: it works inside the perimeter with the rights it was given, and its commands are well-formed.
What we offer
An agent’s right to act only after proof, plus a receipt that an auditor, insurer or court can check. We will quote a pilot price after the first conversation with a customer: a number without a buyer is a hypothesis, not a price.
What already works, and how it is measured
All rows except the last two concern the MITR gate and what surrounds it. “Measured” means an instrument produced the figure; “being built” means the work is under way but has no figures yet.
| What | Status | How to check |
|---|---|---|
| MITR gate measured | Running continuously since 24 April 2026. It has 20 rule contracts, all in enforce mode: an action that is not proven is not executed. The mode was read from the live service on 25 October 2026. | Description of the gate: isslab.ru/en/mitr/. |
| Speed of a check measured | A decision under a rule: 1.08 ms median, 1.96 ms at the 95th percentile; the whole call including the explanation of a refusal: 5.22 ms median. The first decision in a freshly started process: 30.7 ms. Measured on 24 October 2026: 1,000 decisions, 20 contracts, warm process. | The raw series are stored next to the chain; the method is set out in the paper for the ISP RAS conference (submission by 1 November 2026). |
| Attack set on actions measured | 157 cases: 114 attacks and 43 ordinary controls. Attacks missed: 0; false refusals: 0 (24 October 2026). The set itself lists three known gaps in the rules, for example a window in which the checking service can be restarted without approval. Closing them is on the plan. | The institute runs the set itself. No third party has run it yet. |
| Receipt chain measured | 5,094 receipts since 16 September 2026; the chain is consistent from the first record. Once a day an external timestamp witness, OpenTimestamps (a stamp in the Bitcoin blockchain), fixes the head of the chain: on 25 October 2026, epoch 33, 5,079 records. A replay of decisions with the checker written for outsiders matched 5,079 of 5,079. | Anchors and a checker in plain Python: asi5.ru/console/verify/ (in Russian). So far the replay has been run by the institute itself. |
| Six statements about the gate measured | Every day an instrument checks six statements, from “an action cannot go around the gate” to “an outsider can verify the receipt”. All six held for the first time for 23 October 2026. For 24 October, five of six: one was not measured, because the daily report of one connected agent differed from the chain by one receipt. We will consider the gate finished when six of six hold for 14 days in a row. | gate_mode_report.py --six on the gate’s server; the wording is on isslab.ru/en/mitr/. |
| Code tests measured | Nightly run of 25 October 2026: 6,414 tests, 0 failed. | Daily test-suite report on the gate’s server. |
| Open packages measured | mcp-sentinel 1.1.2 (protection of MCP calls), iss-ledger-117 1.1.1 (a log hash-chained under the Russian standard GOST R 34.11-2012, Streebog), iss-agent-kit 0.1.1 and a single-file checker; Apache-2.0 licence. The packages check a call by pattern matching, without a solver: the solver and the externally witnessed chain exist only in the gate. | Files and checksums: isslab.ru/en/mitr/; sources: git.isslab.ru. The packages are not on PyPI. |
| INDRA tester measured | An internal test bench for web services and APIs: 28 labelled scenarios, 14 of 14 vulnerable ones found, 14 of 14 clean ones left untouched; 26 of 26 destructive requests intercepted before sending. Acceptance record of 25 October 2026: 12 criteria of 12. | The record is on isslab.ru/indra/ (in Russian). It is the developer’s record, not a certificate. |
| Book published | Proven Action. Power and Control over AI Agents: Strategy 2027–2035 by A. Fischuk, in Russian. E-book on LitRes since 16 October 2026; the full edition runs to 856 pages. The architectural memorandum (41 pages) and an excerpt (85 pages) are free. | isslab.ru/en/book/ |
| Patent applications filed | Applicant: the institute. 1 June 2026: a method for verifying the actions of an autonomous software agent in real time. 22 September 2026: a method for controlling the claims of an autonomous software agent. No patent has been granted yet, and substantive examination has not started. | The Russian patent office notices are available on request; application numbers will be disclosed after publication. |
| Applied services measured | These are where the method is tried on legal work: sudfact.ru, 14,899 court rulings (corpus measured on 25 October 2026); gosposhlinavsud.ru, a court-fee calculator; fedresurs.org, filings to the Russian register of corporate disclosures. The Juridika service is frozen. All three sites are in Russian. | The services themselves; a live snapshot of the corpus: sudfact.ru/health/corpus. |
What is not there yet
An investor will ask about this at the second meeting. We answer at the first.
- Revenue. The gate has not sold anything yet. The first money is a pilot with an external customer.
- An external customer and a pilot of 30 days or longer. Today the gate checks the actions of the institute’s own agents: 26 receipts on 24 October. The flow is small, and we know it.
- Third-party verification. So far the attack set and the chain replay have been run by the institute. Everything needed for an outside replay is published.
- A certificate. It is not needed to protect one’s own development environment. For significant critical-infrastructure objects in Russia, the established conformity procedure for software applies, after a pilot.
- Patents. Two applications are filed; substantive examination has not started.
- Staff. Why this is a deliberate choice is the next section.
Why the institute has no staff
The institute runs without employees. The scientific director sets the goals, signs the rules and answers for the decisions. Development, verification, upkeep of the site and the logs are done by software agents, and their actions pass through the same MITR gate that we offer to customers.
It is a deliberate set-up: the method is tested on the institute itself. Here is what in this set-up you can check yourself:
The method governs us first
The actions of the institute’s connected agents pass through the gate: 3,877 checks of coding-agent commands, 623 from service code, 30 over MCP (25 October 2026). Every refusal in the last 30 days named the violated condition and how to fix it: 92 of 92. The rule is simple: what has not governed our own agents is not for sale.
A check costs almost nothing
A gate decision does not call a language model; it is a calculation against a rule on an ordinary CPU. Running the 157-case attack set needs no paid models. MITR’s spending on external models is capped at three US dollars a day. The cost is driven by connection and support, not by computation.
Every step leaves a trace
Decisions are kept as numbered records; logs are append-only. A wrong fact is not erased but refuted by a new record in the same chain; there are 94 such records. The next working session starts from a written state, not from someone’s memory.
The figures are checked without us
Every figure on this page has a date and a way to check it. An outsider can replay the gate’s decisions with their own solver and check the time against the Bitcoin blockchain; so far only the institute itself has done this replay. What has to be trusted is the rules, not people, and we have no staff to trust.
The main risk of this set-up is named as well: decisions on goals, money and responsibility rest with one person. The defence is structural: everything reproducible lives in code, registers and decision records, and the machines run without daily human involvement and wake the person up only on an alarm. How the institute is organized is described on the page “How the institute works” (in Russian).
A team will be needed at the stage of regulated customers, banks and critical-infrastructure operators: a formal-methods specialist and a machine-learning engineer. Until that stage, not having one saves a future investor’s money.
Ways to take part
The amount, the stake and the terms are agreed with the scientific director for each specific deal. There is no pilot price and no round size on the site: they are set after a conversation, not before it.
Customer: a pilot
For 30 days the gate runs in observation mode on your agents: actions are not delayed, decisions are recorded. The result is a report built from the receipts: what the agents did, what would have been stopped, under which rule, and the share of false stops. Then the irreversible classes of actions move to enforce mode one by one.
Integration partner
Building the gate into what you deliver: security operations centres, development support, protected customer environments. The rules for industry regulations are written together: a lawyer translates the norm, and the gate proves that an action does not contradict it.
Research partner or grant-maker
Joint research, papers, co-funding of the programme, under a contract with the institute. The nearest item is a paper for the Open Conference of the Ivannikov Institute for System Programming of the Russian Academy of Sciences (submission by 1 November 2026).
Investor
As a Russian autonomous non-profit organization, the institute issues no shares and distributes no profit. For a deal with an investor, an operating limited liability company is set up, which receives rights to the developments under a licence agreement with the institute. Rights to the research results stay with the institute.
Those who want to support the research without a commercial interest can make a donation to the institute’s statutory activity; the details are on the page “Support the institute” (in Russian).
Risks and what we do about them
| Risk | What we do |
|---|---|
| One person at the decision node. | Everything reproducible is kept in code, registers and decision records. A team is a condition of the regulated-customer stage. |
| The market has not been tested by a buyer. | The first pilot is the next step. The price is set from the prevented loss and after a conversation with the customer. |
| A rule may be written wrongly. | The gate guarantees that an allowed action does not break the rule, not that the rule is right. The receipt names the rule, and whoever signed the rule answers for its text. |
| An agent with its own keys bypasses the gate. | This is a property of the installation: the gate holds the keys to the systems, and the agent only sends requests. A bypass shows up in the logs, and the instrument counts it. |
| Certification as a security product has not started. | It is not needed for one’s own development environment; for significant critical-infrastructure objects, the established procedure follows a pilot. |
| The Z3 solver is an open-source library from Microsoft Research. | The programme includes the institute’s own verifiable solver for this logic. |
How to check it yourself
A computer with Python 3 and an internet connection is enough. No registration and no call to the institute are needed.
The gate’s receipt chain
curl -O https://asi5.ru/console/verify/verify_chain_standalone.py.txt mv verify_chain_standalone.py.txt verify_chain_standalone.py curl -O https://asi5.ru/console/verify/gate_anchors-public.jsonl python3 verify_chain_standalone.py gate_anchors-public.jsonl # exit code 0: anchors match python3 verify_chain_standalone.py --explain # the algorithm in words
The time of an epoch is checked with the independent OpenTimestamps client (ots verify), without us. What these data prove and what they do not is explained on asi5.ru/console/verify/ (in Russian).
An open package, offline
mkdir wheels && cd wheels
curl -O https://isslab.ru/wp-content/uploads/iss-utils/mcp_sentinel-1.1.2-py3-none-any.whl
sha256sum mcp_sentinel-1.1.2-py3-none-any.whl
# 681a4db59a1a44e89a2b1386ec4b4f2e1fc23c1025c295b9ebf00fd5d20901ea
cd .. && python3 -m venv .venv && . .venv/bin/activate
pip install --no-index --find-links ./wheels mcp-sentinel
mcp-sentinel check --tool sql_query --args '{"query": "DROP TABLE users;"}'
# BLOCK: the destructive query is stopped, exit code 2
Install the package only with --no-index: a different, unrelated project is published on PyPI under the name mcp-sentinel.
The documents on this page
curl -O https://isslab.ru/wp-content/uploads/2026/10/iss-investor-memorandum-2026-10-25-en.pdf sha256sum iss-investor-memorandum-2026-10-25-en.pdf
Checksums of all documents are listed below.
Materials
Investor memorandum: the content of this page as one document for an investment committee. PDF, in English.
iss-investor-memorandum-2026-10-25-en.pdf · sha256: 17d0713b35f32bc05724e6a4d0a2e7efc35d015c97d9ea5ffb94bb9b3c91d60d
The same memorandum in Russian. PDF.
iss-investor-memorandum-2026-10-25.pdf · sha256: 245144261a0a0c307cd4be5663852551e09a1293d69893b881a10f13639fc023
IS 3.0 verification passport: what has been measured for the MITR gate, the open packages and the INDRA tester, with the commands to repeat it. For a security specialist. PDF, in Russian.
iss-ib30-verification-passport-2026-10-25.pdf · sha256: 68dfaad22cfb18e7ebe1b7ae1cb73ca4716cccf9674e31281b1de4bda52f2a6e
The book Proven Action: the architectural memorandum (41 pages) and an excerpt (85 pages), in Russian.
dokazannoe-deystvie-memorandum.pdf · sha256: ef52f9bcb41b735d6b0b3f2be66c8bbe5aa6cf7a3a353bb27dacc2728828cac9
dokazannoe-deystvie-fragment.pdf · sha256: 26e204e2a445d39f25dd63d3a2f3a4ff8e126911844d2c54c23b5294e6c7ccab
Corporate documents, in Russian: extract from the Unified State Register of Legal Entities and company details card.
Legal details and contact
- Organization
- Autonomous Non-Profit Organization “Scientific Research Institute of System Synthesis” (ANO “NII Sistemnogo Sinteza”)
- OGRN · INN · KPP
- 1267700083617 · 9731161602 · 773101001 (state registration number, taxpayer number, tax registration code)
- Address
- 18 Davydkovskaya Street, premises VIII, Moscow 121352, Russia
- Scientific director
- Alexander A. Fischuk
- Contact
- Directly to the scientific director: Telegram @afischuk. Institute e-mail: info@isslab.ru; telephone +7 495 295-09-11.
Institute of System Synthesis. Edition of 25 October 2026. Figures are given with the date of measurement; they change with the next measurement, and earlier values remain in the receipt chain. This page is not a public offer: the terms of participation are set by contract. Checked: 25 October 2026: the status of the standard named on this page (GOST R 34.11-2012) and the institute’s legal details, against primary sources.