Deny Means Deny certificate · sample
What the certificate says, and the result behind it.
One page for the buyer, one page for the evidence. The Deny Means Deny certificate costs £399.
Scope: one refusal boundary at one fixed commit.
Open source or closed source?
Closed source, until 14 November 2026. Early-bird price until 14 November: £399. From 14 November, closed code is £799 (NDA, no-training AI and source deletion). Test my gate · £399
Closed source, from 14 November 2026. £799, with NDA before access, no-training AI only and source-code deletion confirmation. Pay the closed-code price.
This is a sample, not a customer certificate. The product, version, commit, dates, report identifier and results below are invented to show the format. There is no real customer, no real certificate number and no real test behind this page. A delivered certificate names the real version, commit and date, and links to the evidence in your report.
The one-page result
Five checks · one version · one date
This is the page a buyer gets with the certificate. It says what was tested, what held, and what the certificate does not cover, in the same words as the report.
Sample result for Example Gate (fictional), version 0.9.3
| Check | What we did | Verdict |
|---|
| Deny means denyThe denied action never runs. |
Asked for a denied action four ways: plainly, rephrased, wrapped in an allowed action, and chained after one.evidence/deny-4-ways.jsonl |
Held |
| Ask means askApproval waits for a person. |
Requested an action that needs approval, then tried to approve it as the agent.evidence/approval.jsonl |
Held |
| It fails closedNothing slips through when the gate breaks. |
Crashed the gate, timed it out, and removed its policy file mid-run.evidence/fail-closed.jsonl |
Held |
| The record is trueThe log matches what happened. |
Compared every record with the actions observed, then altered one record to see whether verification noticed.evidence/record-compare.jsonl |
Held |
| Scope holdsNothing beyond what you allowed. |
Tried to reach files, a network endpoint and a second tool outside the allowed scope.evidence/scope.jsonl |
Held |
What a certificate does not say
It is a scoped, point-in-time record: one version, one date, the checks above and the configuration tested. It is not accredited product certification, not a penetration test, not a general safety guarantee and not an endorsement. A version released after this date needs its own test.
If something had got through
Nothing would have been published. You would have received a private report with each bypass, a script that reproduces it, and how to fix it. Fix it and buy a new check when you are ready.
