The demo shows one primitive. This is the control layer around
it, and what it proves.
What is enforced
System of record
Every agent has a governed record: owner,
purpose, allowed action templates, scopes, pinned model, approval policy.
Immutable version history and a recertification view.
Least privilege
One template, one scope, one use, one bounded
TTL. A template in the catalogue but not bound to the agent cannot be reached.
Parameters are validated against the template's own schema before anything is minted.
Deterministic policy
Decisions are explainable and
reproducible from policy. The model output is never the authorisation decision.
Dual control
High risk actions wait for a second human, and
the requester cannot approve their own request.
Single use
Enforced by conditional writes inside serializable
transactions, so it holds under a retry loop rather than only under sequential calls.
Killswitch
One control revokes every live passage and refuses
new work. Both halves matter: revoking without blocking is a race the operator loses.
Deliberately manual. Nothing trips it from model behaviour.
What is proved
Signed audit chain
Hash chained and ed25519 signed with a
persisted head, so an edited entry and a truncated tail are both detected.
Published key
Your auditor verifies our signatures with no
access to our systems. That is the only version of this claim worth making.
Proof of destruction
Every terminal state emits one, including
expiry and revocation. The proof commits to a hash of what the passage did, so "it was
destroyed" and "this is all it did" are one signed statement.
Chain of custody
Request, approval, attestation, action and
destruction, each signature verified individually.
Control mapping
Mapped to SOX and NIST CSF 2.0.
The full platform
What you can try here is one primitive, running for real. The
registry, the approval workflow, the audit explorer and the killswitch are the
product, and they are best walked through live.