The system,
explained.
For the engineer who needs to see the wiring before they trust it. Every agent runs in a locked-down sandbox with no route out, every model call passes through one broker, and every action signs into an audit chain you re-verify offline.
It’s enforced at the layer below the agent, so it can’t talk its way around it. No magic — just rigor.
Sandbox in. Signed proof out.
Four controls, in order. Each is enforced below the agent — so the agent can't reason its way past them.
No-route sandbox DOCKER · NO EGRESS
Each run executes in its own Docker container on an internal-only network — no gateway, no route to the internet. The agent physically can't open an outbound connection; the only thing it can reach is the broker. There's nothing to detect, because nothing can leave on its own.
Sole-egress broker ONE DOOR OUT
The broker is the only process on the box that can reach a provider. It holds your keys and injects them at call time, so the secret never enters the agent container. Every call is policy-checked at the broker — known model, budget not exceeded, kill-switch clear — and signed before it leaves. When a run genuinely needs the open web, that door is governed too — deny-by-default, tap-to-approve, byte-capped both ways, every request signed: governed and audited egress, never a blind pipe.
BYOK key vault LIBSODIUM-ENCRYPTED
Bring your own provider key. It's encrypted at rest in a per-tenant encrypted vault, never logged, and never transmitted for our own use. The broker decrypts it in-memory for exactly one call, then it's gone — the key never enters the container.
Signed audit chain RE-VERIFY OFFLINE
Every action — prompt hash, tool call, output, routing decision, kill — is Ed25519-signed and hash-chained. Export the run and re-verify every event on your own machine with our open tool. Tamper one byte and verification fails.
NET: NONE— THE ONLY DOOR →BROKER
VAULT · POLICY · SIGN— KEY INJECTED PER CALL →PROVIDER
Agent containers run on an internal-only network with no route to the internet. The single broker holds the keys and is the only path out — every call is policy-checked and signed. The agent never holds a key, and never gets to leave on its own.
Zero implicit trust, anywhere.
Containment isn't one wall — it's a stack of them, each independently enforced.
Tenant isolation
App-scoped data access: every record is filtered by tenant, and a cross-tenant request fails closed — it returns “not found”, not “forbidden”, so it can't even be used to enumerate what exists.
FAILS CLOSEDSigned internal calls
Every call between internal services is authenticated and rejected if unsigned. No service trusts another by default, and none can impersonate another — the same posture engineers expect inside a hardened system.
ZERO IMPLICIT TRUSTRuntime containment
A host-authoritative watchdog — running outside the sandbox, where the agent can't reach it — SIGKILLs a run on kill-switch, budget breach, or heartbeat loss. An escaped agent can't stop the thing that kills it.
HOST-SIDE WATCHDOGWe’d rather you trust the parts you can check. The live container path gives you sandbox isolation, sole-egress brokering, BYOK vaulting, cost caps, a kill switch, and a signed, offline-re-verifiable chain. CMMC L1/L2 is self-assessed; a SOC 2 Type II audit is targeted for Q3 2026 — and where something is on the roadmap, we say so.
See it run for
yourself.
Start a sandboxed agent, export the signed audit log, and re-verify it offline with our tool. No trust required — just evidence you hold.