Governance in the runtime, not the prompt.
A self-hosted agentic engine: per-person identity, deny-by-default policy, a kernel-enforced jail, and a hash-chained audit ledger.
Agentic AI writes code faster than your controls can review it.
The tools your developers already want run with the developer's own OS privileges, on a machine you don't control, against a vendor API you can't inspect. Excellent engineering tools. Not designed to be accountable. For an agency, that leaves four questions no current tool answers.
Who acted?
An API key is not an identity. Actions attribute to a token, not a cleared person.
What was it allowed to do?
Guardrails written into a system prompt are requests, not controls. Anything that can read the prompt can argue with it.
Where did the data go?
Source, prompts and telemetry leave the boundary by default.
Can you prove any of it later?
Session transcripts are editable, unordered and incomplete. A tool that cannot answer these four questions cannot be placed inside an ATO boundary.
Move the guardrail out of the prompt and into the runtime.
A prompt-level rule is advice to a model. A runtime gate is a decision made before the tool executes, by a policy engine the model cannot address, using an identity the model cannot forge.
No enforcement point. The only thing between the model and your systems is its own cooperation.
Cedar is AWS's open-source authorization engine, used here as a deny-by-default gate on every tool dispatch. The model never sees the policy and cannot address it.
We tested the containment by removing it.
Anyone can show a green checkmark. The column that means something is the one on the right: what the same hostile command does when the control is taken away. If a control cannot be shown failing, it was never proven working.
| Hostile action attempted | Contained | Control removed |
|---|---|---|
| Read other developers' home directories | 1 visible, its own | 15 visible |
| Read other users' workspaces | 1 visible | 36 visible |
| Reach /etc/shadow | absent from filesystem | present |
| Reach the executor's own control socket | absent | world-visible |
| Exhaust memory (3 GiB allocation) | SIGKILL at ceiling · oom_kill 2 | 6.7 GiB and climbing |
| Fork bomb | halted at 512 processes | 100 of 100 spawned |
| Reach a non-approved internet host | refused at the proxy | connected |
The standing ruleOur engineering standard requires that any security claim cite a test that fails when the property is removed, and that the removal was actually run. A lint enforces the citation; claims that cannot be substantiated are retracted from the documentation.
Why we adopted itFour of our own tests were found passing by vacuum, asserting things that were true for the wrong reason. One "verified" a licence by matching a phrase in a comment. Mutation testing is the only thing that catches that.
Four commitments. Each one testable.
Platform properties, not aspirations. They hold for every orchestration registered on the runtime, whether we wrote it or you did. Each maps to a mechanism, and each mechanism has a test that fails when you remove it.
eXpedited Decisioning
Multi-agent orchestration that turns backlog into finished, reviewed work. Not suggestions. 32 specialist agents; a 47-node patents DAG.
Compliance-First Architecture
Deny-by-default authorization and blocking quality gates the pipeline cannot skip. Waiving one needs typed human intent, recorded.
Enterprise-Grade Security
Untrusted code runs in a kernel-enforced jail under a named identity, bounded by cgroup ceilings and written to the ledger.
Legacy Modernization
Maps decades-old codebases before changing anything, and reaches your systems of record through a broker that never holds a token.
The controls your assessor will ask about, and where each one lives.
Each row is a mechanism in the running system, with the NIST 800-53 rev5 family it speaks to. An indicative mapping, not a control assessment.
Say this plainly to your security team: the policy engine, the execution sandbox, the identity plane and the audit chain are ours, run inside your boundary, and open to your inspection.
The limits, stated before you ask.
A vendor who tells you everything is finished is telling you they have not looked. These are the open items on our own register today.
- No ATO, no FedRAMP authorization
The architecture maps to NIST 800-53 control families and we will support your assessment. We have not been through one. Ask any vendor claiming otherwise for the package number.
- Egress allow-listing is policy, not containment
It governs well-behaved programs. A determined process can bypass a proxy. Full network containment requires an isolated network segment, scoped per deployment.
- Connector reads are unproven end to end
The authorization path is verified to the provider's own login page. No production OAuth application has been registered, so a live read of a customer system has not yet been observed.
A two-week evaluation, inside your boundary.
We deploy into your environment, connect to your identity provider, and run your work. Not a demo dataset.
Self-hosted deployment behind your boundary. Okta or PIV/CAC integration. Your security team reviews the policy set and the audit chain format.
One modernization backlog, executed under gates. You keep the ledger, the code and the deployment whether or not you proceed.
We run the containment tests in front of your engineers, including with the controls switched off.
Ask every other vendor to show you what happens when they turn the control off.