Capability brief · Government acquisition

Governance in the runtime, not the prompt.

A self-hosted agentic engine: per-person identity, deny-by-default policy, a kernel-enforced jail, and a hash-chained audit ledger.

Append-only ledger · genesis-anchored Demonstration
0000genesis0000000000000000…anchor
0001shell.execprev 0000 · 9f2c…41aballowed
0002connector.invokeprev 0001 · c17e…8d03refused
principal: okta:j.reyes@agency.gov refusals recorded as carefully as successes
Self-hosted
OIDC / PIV-CAC
Cedar ABAC
Hash-chained audit
No vendor egress

Agentic AI writes code faster than your controls can review it.

The tools your developers already want run with the developer's own OS privileges, on a machine you don't control, against a vendor API you can't inspect. Excellent engineering tools. Not designed to be accountable. For an agency, that leaves four questions no current tool answers.

Who acted?

An API key is not an identity. Actions attribute to a token, not a cleared person.

What was it allowed to do?

Guardrails written into a system prompt are requests, not controls. Anything that can read the prompt can argue with it.

Where did the data go?

Source, prompts and telemetry leave the boundary by default.

Can you prove any of it later?

Session transcripts are editable, unordered and incomplete. A tool that cannot answer these four questions cannot be placed inside an ATO boundary.

Move the guardrail out of the prompt and into the runtime.

A prompt-level rule is advice to a model. A runtime gate is a decision made before the tool executes, by a policy engine the model cannot address, using an identity the model cannot forge.

Typical agentRule lives in the prompt
Prompt"don't touch prod"
Modelmay comply
Toolexecutes
Your systemsfull operator rights

No enforcement point. The only thing between the model and your systems is its own cooperation.

XcelAI StudioRule lives in the runtime
Modelrequests a tool
Cedar gatedeny by default · Okta principal
Jailed executorbwrap · cgroups · per-identity home
Your systemsonly what policy allows · every call on the ledger

Cedar is AWS's open-source authorization engine, used here as a deny-by-default gate on every tool dispatch. The model never sees the policy and cannot address it.

Evidence · the difference that matters

We tested the containment by removing it.

Anyone can show a green checkmark. The column that means something is the one on the right: what the same hostile command does when the control is taken away. If a control cannot be shown failing, it was never proven working.

Hostile action attemptedContainedControl removed
Read other developers' home directories1 visible, its own15 visible
Read other users' workspaces1 visible36 visible
Reach /etc/shadowabsent from filesystempresent
Reach the executor's own control socketabsentworld-visible
Exhaust memory (3 GiB allocation)SIGKILL at ceiling · oom_kill 26.7 GiB and climbing
Fork bombhalted at 512 processes100 of 100 spawned
Reach a non-approved internet hostrefused at the proxyconnected

The standing ruleOur engineering standard requires that any security claim cite a test that fails when the property is removed, and that the removal was actually run. A lint enforces the citation; claims that cannot be substantiated are retracted from the documentation.

Why we adopted itFour of our own tests were found passing by vacuum, asserting things that were true for the wrong reason. One "verified" a licence by matching a phrase in a comment. Mutation testing is the only thing that catches that.

Four commitments. Each one testable.

Platform properties, not aspirations. They hold for every orchestration registered on the runtime, whether we wrote it or you did. Each maps to a mechanism, and each mechanism has a test that fails when you remove it.

X

eXpedited Decisioning

Multi-agent orchestration that turns backlog into finished, reviewed work. Not suggestions. 32 specialist agents; a 47-node patents DAG.

C

Compliance-First Architecture

Deny-by-default authorization and blocking quality gates the pipeline cannot skip. Waiving one needs typed human intent, recorded.

E

Enterprise-Grade Security

Untrusted code runs in a kernel-enforced jail under a named identity, bounded by cgroup ceilings and written to the ledger.

L

Legacy Modernization

Maps decades-old codebases before changing anything, and reaches your systems of record through a broker that never holds a token.

The controls your assessor will ask about, and where each one lives.

Each row is a mechanism in the running system, with the NIST 800-53 rev5 family it speaks to. An indicative mapping, not a control assessment.

Control area
How XcelAI implements it
Speaks to
Identification & authentication
OIDC authorization-code flow with PKCE and DPoP sender-constrained tokens. Okta or Keycloak; PIV/CAC and Login.gov supported. No shared API keys.
IA-2, IA-5, IA-8
Access enforcement
Cedar ABAC evaluated before every tool dispatch, deny-by-default. Per-tool and per-integration scopes carried as token claims the runtime cannot widen.
AC-3, AC-6, AC-24
Separation of duties
Blocking gates require typed human intent to waive, recorded with actor, reason and timestamp. The orchestrator can never waive its own gate.
AC-5, CM-3
Least privilege at execution
Non-root uid, all capabilities dropped, no-new-privileges, read-only root filesystem, namespace jail, cgroup v2 memory and pid ceilings.
AC-6, SC-39, SI-16
Boundary protection
Isolated internal networks, no published ports on credential stores, egress mediated by an allow-listing proxy, admin planes refused at the reverse proxy.
SC-7, SC-7(5)
Transmission & storage
TLS with certificate pinning on machine-to-machine hops; credentials encrypted at rest; secrets never enter a model context or a child process environment.
SC-8, SC-12, SC-28
Audit & accountability
Append-only hash-chained ledger, genesis-anchored, recording principal, tool, decision and outcome. Rotation writes continuation anchors; retention writes audited tombstones.
AU-2, AU-3, AU-9, AU-12
Software integrity
Content-addressed pipeline delivery with SHA-256 verification completing before the first byte is written; binary and TLS pinning on registered servers; SBOM produced for the workspace.
SI-7, SR-4, SR-11
Flaw remediation
Dependency CVE scan, secret detection and environment-variable audit run as a blocking release gate, not a reporting job.
RA-5, SI-2
Accessibility
Automated WCAG / Section 508 scan blocks on serious or critical findings; waiver requires typed human intent.
Section 508

Say this plainly to your security team: the policy engine, the execution sandbox, the identity plane and the audit chain are ours, run inside your boundary, and open to your inspection.

What we will not claim

The limits, stated before you ask.

A vendor who tells you everything is finished is telling you they have not looked. These are the open items on our own register today.

  • No ATO, no FedRAMP authorization

    The architecture maps to NIST 800-53 control families and we will support your assessment. We have not been through one. Ask any vendor claiming otherwise for the package number.

  • Egress allow-listing is policy, not containment

    It governs well-behaved programs. A determined process can bypass a proxy. Full network containment requires an isolated network segment, scoped per deployment.

  • Connector reads are unproven end to end

    The authorization path is verified to the provider's own login page. No production OAuth application has been registered, so a live read of a customer system has not yet been observed.