What the institute does
The institute works on one problem from several sides: how to make sure that a program acting on its own does nothing impermissible. Below are seven areas of work, each saying who it is for, what a person or an organization gets and how to start.
Checking the actions of software agents
- Who it is for
- Banks, operators of critical infrastructure and companies that give agents payments, correspondence and data work.
- What one gets
- Every action of an agent is checked against the organization’s rule before it runs, a refusal names the violated condition, and every decision gets a receipt.
How to start: A thirty-day pilot · What MITR is
A log that an outsider can check
- Who it is for
- Security services, auditors and those who report to a regulator.
- What one gets
- An entry cannot be quietly rewritten: receipts are chained, an external time witness fixes the head of the chain once a day, and an outsider recomputes the chain on their own machine.
How to start: The action receipt · Verification protocol
Testing web services for vulnerabilities
- Who it is for
- Owners of web services and programming interfaces, security testing teams.
- What one gets
- The INDRA bench tests seven classes of vulnerabilities with safe probes and turns a vulnerability it finds into a draft rule for MITR.
How to start: The INDRA page, in Russian
Open tools for developers
- Who it is for
- Engineers and agent developers.
- What one gets
- The mcp-sentinel, iss-ledger-117 and iss-agent-kit packages are released under the Apache-2.0 license, install offline with checksums and show the method on one’s own scenarios.
How to start: Packages and checksums
A book for executives
- Who it is for
- Owners and chief executives.
- What one gets
- The book “Proven Action” answers who controls an agent and who answers for its mistake, and proposes a strategy for 2027–2035.
How to start: About the book
Research
- Who it is for
- Research partners and grant-makers.
- What one gets
- A research program on formal verification of program actions, two patent applications filed on 1 June and 22 September 2026, and a paper being prepared for the Open Conference of the Ivannikov Institute for System Programming of the Russian Academy of Sciences.
How to start: The program, in Russian
Legal services
- Who it is for
- Lawyers and companies that work with court practice and mandatory publications.
- What one gets
- The court practice analysis system (SUDFACT) holds 14,899 court decisions as of 26 October 2026, and the mandatory publications service (FEDRESURS) accepts and handles publications in the register.
How to start: SUDFACT, in Russian · FEDRESURS, in Russian
Starting a conversation
Every route starts with a letter to info@isslab.ru or a message to the scientific director on Telegram, @afischuk. A pilot, a partnership and an investment are described on their own pages: a pilot at a customer, partners and investors.