Verifiable autonomy