Architecture
Built to be checked, not just to run.
Single-tenant, in your environment. Postgres for the record, row-level security on every workspace-scoped table, Cedar for the stateless half of a policy, and an evidence plane that seals what happened whether or not anybody asked it to.
Where it runs, and what leaves
Everything below the line is yours: your account, your network, your Postgres. One optional path crosses it and carries a hash.
- 1 · your agent asks before it acts
- 2 · decision path nine gates, fixed order, one of six outcomes with the reason
- 3 · the action happens, or is refused and does not
- 4 · evidence path written as it happens, sequenced, sealed into Merkle batches
Two halves that must not be one
- The decision path
- Nine gates in a fixed order, evaluated before the action, returning one of six outcomes with the reason attached. Cheap structural checks first and the budget debited last, so an action refused by policy costs nothing.
- The evidence path
- Trajectories and steps written as they happen, sequenced, sealed into Merkle batches, anchored externally. Capture fails open and enforcement fails closed — a recording problem must not cause an outage, and an unreachable control plane must not silently permit an ungoverned action.
- Policy, split deliberately
- Cedar decides predicates over one action; cumulative bounds stay in columns. A policy language decides and does not account — asking one to track a running total across a delegation tree is asking it to be a ledger.
What it never does
No model is called on any path
Not for a summary, not for a digest, not for classification. Asserted by a test that fails the build if a model provider appears in the dependency graph — which is a stronger claim than having an AI feature, and a rarer one.
observed →No payload leaves the deployment
The outbound connections are enumerable and probed rather than described. Airgapped mode refuses every one of them outright, including external anchoring — and says which evidence property you have therefore given up.
observed →The identifier value is never stored
A personal-data finding is a label on a record — family, confidence, count — and never a copy of the value. A finding that stored the identifier would be a second copy of the thing somebody asked to erase.
observed →