Establishing a Private Cloud Trust Harness for Humans and AI Agents

When an AI agent reads your production code, calls your APIs with live credentials, or accesses customer data, sensitive prompts and context are sent to model infrastructure for inference. In a standard setup, that data is typically processed in plaintext within the provider's serving environment. Audit logs can show that a request happened, but they do not prove that the data stayed protected during inference or that the agent was authorized to make the call.

NEUS, Phala, and RedPill combine confidential inference with verifiable agent authority to close that gap. In this setup, inference runs inside confidential hardware, the runtime is verified through ACI attestation, and NEUS records the authority and outcome of agent actions as signed proofs.

The Trust Harness

The trust harness combines three layers into one pipeline.

Sealed inference. Phala provides the confidential compute substrate. Model calls execute inside Trusted Execution Environments: NVIDIA H100 and H200 GPU enclaves for model execution, and Intel TDX confidential VMs for orchestration and pre/post-processing. Sensitive prompts, keys, tools, and agent memory remain protected within the confidential runtime. For NEUS hosted inference, RedPill routes model requests through this confidential path.

Attested runtime. Phala's ACI attestation lets NEUS verify that the service is running inside genuine TDX hardware and that the measured workload matches the runtime evidence. The attested keyset anchors the secure connection and later inference evidence. NEUS now exposes response-specific verification details so users can inspect the checks behind the trust signal, including hardware attestation, runtime measurement, secure connection, signed receipt, request and response integrity, and upstream session verification. Any skipped check is disclosed rather than counted as a pass.

Governed action. NEUS governs who can act, under what authority, and within what scope. When a team delegates authority to an agent, NEUS creates a signed proof that binds the agent's identity to permitted actions and constraints. Each action can then be linked back to the authority that allowed it and the verified runtime that served the inference.

A verifier can inspect both layers: the NEUS proof establishes the agent's authority, while the ACI evidence establishes how the inference was served.

The Cloud Agent Runtime

The trust harness is the environment where agents live, receive tasks, call models, execute actions, and produce verifiable outputs. Here is how a single agent action flows through it.

Delegation. A user delegates authority to an agent through a signed NEUS proof tied to the agent's identity. The proof defines what the agent can do, which resources it can access, and how long the authority is valid.

Task execution. The agent receives a task, constructs a prompt, and calls a model through RedPill. RedPill routes the request into Phala confidential compute.

Sealed inference. Inside the confidential runtime, the prompt is processed on isolated NVIDIA H100/H200 GPU or Intel TDX infrastructure and the output is returned through the protected path.

Runtime verification. NEUS verifies the ACI service and requires verified serving for the inference request. The response-specific evidence links the call back to the verified confidential runtime and can be inspected directly from the verification details view.

Proof. NEUS records a signed proof that this agent, under this delegated authority, executed the inference through the verified confidential path.

Each action now has two verifiable layers of evidence: ACI evidence showing how inference was served, and a NEUS proof showing the agent's identity and authority. Together they provide a verifiable path from delegation through execution.

Where This Wins First

Agent teams with production access. An engineering team deploys a multi-agent system where one agent writes code, another reviews pull requests, and a third deploys to production. Each agent has different permissions: the coder can read the repo, the reviewer can comment but not merge, and the deployer can push to staging but not production without approval.

The team delegates authority to each agent through NEUS, issuing signed proofs that scope each agent to its specific role and permitted actions. The hosted inference path routes model calls through RedPill into Phala confidential compute, keeping proprietary code, internal docs, and API keys protected during inference.

When something goes wrong, the team can trace which agent made the call and under whose authority. NEUS proofs show the delegation path, while ACI evidence shows how the inference was served. No guessing, no log archaeology.

Agents handling customer data. A startup ships an AI agent that reads customer support tickets, analyzes usage patterns, and drafts responses. The agent has access to customer PII, conversation history, and product telemetry. Conventional hosted inference can expose that data to the normal model-serving environment.

The founder delegates authority to the agent through NEUS, scoping it to specific data sources and permitted actions. The agent calls the model through the RedPill confidential inference path on Phala. Customer data remains protected during inference instead of being exposed to the normal model-serving stack.

The startup can show customers that sensitive inference was handled through a verified confidential runtime and that the agent acted under explicit, scoped authority. Both layers are independently verifiable rather than relying only on vendor assurances.

Multi-agent systems with shared credentials. A platform team runs a fleet of agents that each need access to different internal APIs, databases, and third-party services. Shared credentials increase the blast radius when an agent or key is compromised.

With the trust harness, each agent gets a scoped NEUS proof defining which resources it can access. Sensitive credentials remain protected inside the confidential runtime, and the team can revoke the agent's authority when needed. Every call can be tied back to the specific agent and delegation that authorized it.

Why This Matters Now

Teams are shipping AI agents into production workflows that touch proprietary code, customer data, and live infrastructure credentials. Most infrastructure was built for throughput and cost optimization, not for proving what happened. Audit logs can record that requests occurred, but they do not prove that sensitive inference was protected or that the agent was authorized.

The trust harness replaces policy alone with verifiable evidence: confidential inference from Phala and RedPill, governed action from NEUS, and ACI verification connecting the runtime to the inference path. One pipeline, with each layer independently checkable.

This is the runtime agentic teams need: a cloud agent runtime where agents think in protected hardware and act with signed proof of authority.

Govern your AI agents at neus.network. Explore Phala's confidential compute infrastructure at phala.com.