Thread 1
One identity, from a person to a field device
Every action anywhere in the estate traces back through an unbroken cryptographic chain to a human or an organization that authorized it. There is no point in the chain where the answer becomes “a service account somebody made in 2019.”
| Link | What it holds |
|---|---|
| Person | Credentials, multi-factor authentication, and an authority they can delegate from. |
| Agent | An Ed25519 principal and an X.509 certificate carrying ID and clearance, holding a bounded slice of that person's authority. |
| Sub-agent | A grant minted from the parent's sealed grant, resolved server-side. A custody-key mismatch fails closed. |
| Device | An ECDSA P-384 key generated on the device and bound to a hardware fingerprint, with a delegation the platform can revoke in one call. The private key never traverses the wire. |
| Where | What carries identity |
|---|---|
| A person | Credentials, multi-factor authentication, and an authority they can delegate from |
| An agent | An Ed25519 principal and an X.509 certificate carrying its ID and clearance, holding a bounded delegation of that person's authority |
| A sub-agent | A grant minted from the parent's sealed grant, the model supplies intent, never identity |
| A device | ECDSA P-384 generated on-device, private key never on the wire, bound to a hardware fingerprint |
| A workload | Workload identity documents, and service tokens carrying delegation chains |
| A cell | A cell identity key, with mutual TLS on every inter-cell call |
| A node | A cryptographic identity that survives cell replacement, the face peers see |
| An organization | Mints nodes, holds a certificate authority; cross-organization moves absorb authorities under quorum |
| An external agent | A signed agent card published through a public key endpoint |
So what
Ask a rival to draw this diagram.
Thread 2
One classification ladder, enforced on every path
Five levels plus compartments, defined once. Most platforms enforce classification in the catalog and hope nobody reaches the engine another way.
| Layer | How it is enforced |
|---|---|
| Object storage | A property of the namespace with a database constraint, enforced in the data path |
| Storage lifecycle | A classification floor on automatic tiering; an unrecognised label fails closed to no movement |
| Streams | Ingest level at or below namespace level; query clearance at or above data level; a guard on cross-domain transfers |
| Query engines | Row filters and column masks compiled into the plan of eight engine types |
| Kernels | Row and column security enforced inside the execution kernel, not in front of it |
| Functions | The isolation tier is raised by the classification of the data touched |
| Messaging | A message carries the same classification as a table |
| Clean rooms | Compartment labels and region constraints |
| Agents | Clearance is a hard constraint on workflow placement, not a preference |
| Models | Read-down output redaction and a classification gate on inference |
| The edge | Classification, compartment and data-grant enforcement on every edge AI query |
| Cross-domain | Upward transfer allowed; downward requires explicit authorization; every attempt audited |
So what
A label applied once is honoured everywhere, including on a device with no network.
Thread 3
Everything is chained, and each chain proves a different thing
The platform does not have “an audit log.” It has thirty-one independent tamper-evident chains, enumerated and counted in code, each answering a specific question an auditor asks.
| Layer | Chains it carries |
|---|---|
| Directory | Directory lifecycle; cross-organization federation; schema and data migrations. |
| System | Core system audit; external database-credential use; database maintenance. |
| Security | The security audit log; the read-audit chain proving who looked. |
| Crypto | The crypto ledger Merkle audit with external witness bundles; cell attestation. |
| Data | Per-cell lineage with deny-by-default capture; the data audit chain; canonical knowledge fusion. |
| Storage | Storage access, with counted gaps; object provenance. |
| Messaging | Message chain of custody, carrying the same classification as a table. |
| Radio | Tactical-radio COMSEC audit. |
| Workspace | The workspace activity ledger with a verify endpoint; the entity activity log. |
| Catalog & clean room | The clean room's own run chain; the catalog promotion ledger; share access. |
| Exchange | The settlement chain, independently verifiable; deny receipts for refused requests. |
| Compute | Coding diff receipts, verifiable offline; the job ledger. |
| Agents | The decision audit chain, co-witnessed by peer cells. |
| Capacity | Compensation decisions, share edits and noisy-neighbour verdicts. |
| Billing | The meter audit chain, independently verifiable, with gap detection. |
| A counted gap | When an append fails, the gap is written as a first-class record. An append-only file's absence proves nothing; a counted gap proves something. |
| Chain | The question it answers |
|---|---|
| Directory lifecycle audit | What changed in the directory, who was created, moved or removed? |
| Federation audit | What crossed an organization boundary, and under whose authority? |
| Migration audit | What did this schema or data migration actually do? |
| System audit chain | What administrative action was taken on this cell? |
| Database-credential audit | Who used or rotated an external database credential? |
| Maintenance audit | What ran during database maintenance? |
| Security audit log | What security-relevant event happened, and was any record removed? |
| Read-audit chain | Who read this, and can that be proven after the fact? |
| Crypto ledger Merkle audit | Was the key material tampered with?, with external witness proof bundles |
| Attestation log | What did this cell attest to, and is the attestation intact? |
| Data audit chain | What happened to this data, and in what order? |
| Lineage chain, per cell | Where did this data come from?, deny-by-default capture |
| Knowledge fusion chain | How was this canonical record assembled from its sources? |
| Storage audit chain | Was an object access removed from the record?, with counted gaps |
| Object provenance ledger | What is the provenance of this stored object? |
| Message chain of custody | What message crossed the bus, and at what classification? |
| Radio COMSEC audit | What happened on the tactical radio, and was COMSEC preserved? |
| Workspace activity ledger | What happened in this workspace? |
| Entity activity log | What did this entity do across its workspaces? |
| Clean-room ledger and signature chain | What ran in this room, approved by whom? |
| Catalog promotion ledger | What was promoted into the catalog, and by whom? |
| Share access log | Who accessed this share, and when? |
| Exchange settlement chain | Is this settlement line real and independently verifiable? |
| Exchange deny-receipt chain | What exchange request was denied, and why? |
| Coding diff receipts | Which agent wrote this line, and has the diff changed since?, verifiable offline |
| Job ledger | Who dispatched this work, and where did it go? |
| Decision audit chain | Why was this action allowed or refused?, co-witnessed by peer cells |
| Capacity compensation decisions | Why was capacity compensated on this cell? |
| Capacity share edits | Who changed a capacity share, and to what? |
| Noisy-neighbour verdicts | Why was this workload judged a noisy neighbour? |
| Metering audit chain | Is this invoice line real?, hash-chained, independently verifiable, with gap detection |
So what
“We log everything” is what everyone says. “Here are thirty-one different things we can prove, and here is the mathematics for each” is a different conversation, and it is the one that shortens an audit.
Thread 4
What refuses, and what proves it refused
The most under-sold property in the platform. Most systems permit and log. This one refuses at the boundary and records the refusal.
| The refusal | Where |
|---|---|
| A net-negative action, scored across the whole system | The decision gate at the action boundary |
| An agent's own consequential act | Halt and escalate, beyond its authority |
| A plaintext write when encryption is armed | The block store refuses, rather than warning and proceeding |
| An operation we cannot enforce | S3 returns 501 rather than accepting and ignoring |
| Raw rows leaving a clean room | The egress gate, deny-all by default; first failure terminates the run |
| An unsigned or badly-signed policy | The cell rejects it and holds last-known-good |
| A write to a fenced cell | Rejected outright rather than risking split-brain |
| A workflow on a cell below the required clearance | A hard placement constraint |
| A sub-agent mint with a custody-key mismatch | Fail-closed |
| An algorithm off the compliance profile | Startup and runtime gates fail closed |
| A query inferring through a masked column | Predicate protection blocks or rewrites it |
| A catalog write violating a data contract | The contract enforcer |
| A full deep clone of a workspace | Consults the gate; refuses with 403 |
| A clean room leaving its organization | Default-prohibited without recorded consent from every collaborator |
| Egress from a sandbox | No network interface is granted; no bind outside the allowlist is representable |
| An automatic failover to store-and-forward | Refused by design. It would let an outage read as success |
So what
Ask a rival what their platform refuses, and where the record of the refusal lives. Most cannot answer, because permit-and-log is the industry's default posture. This is demonstrable live in about a minute, and it is the deposit that makes every other claim spendable.
Thread 5
What still works when the network does not
The thread no cloud-first platform can answer, and the one to lead with for defense, industrial and sovereign estates.
| Carrier | Role |
|---|---|
| gRPC over mutual TLS | Primary. Direct to the cell's service ports, with token-by-token streaming for AI queries. |
| HTTPS / REST | Secondary, through the node's public gateway. |
| WebSocket | Tertiary, for networks that block gRPC and long-poll HTTPS alike. Every frame attests its delegation chain. |
| SSH tunnel | Bastion-style relay for estates whose only way in is a jump host. |
| MQTT | Constrained and low-power links. Refuses an AI query rather than publishing cleartext to a broker when the sealing key is absent. |
| DNS-over-HTTPS | Heartbeat-class traffic only, and we do not claim more than that. |
| Air-gapped posture | Writes a signed bundle for an operator to carry; the device never dials. Outside the ladder, because failing over to store-and-forward would let an outage read as success. |
| Capability | Disconnected behaviour |
|---|---|
| Starting up | Nothing phones home to start, proven for all eleven startup entrypoints by test |
| Licensing | Verified entirely offline; the signing key never leaves a hardware module; a monotonic ratchet defeats clock rollback |
| Entitlement expiry | Thirty days grace, then thirty days read-only, then administrator access and export. Nothing goes dark on day one |
| Configuration | Last-known-good signed policy, still reconciling locally; new policy accepted by signed offline bundle |
| Certificates | Pre-provisioned material and a subordinate authority, so a cut-off cell still issues and validates |
| Inference | A local model runtime on both cell and device, no vendor, no egress |
| Document understanding | Extraction, chunking and ontology-guided entity extraction run on the device |
| Working storage | A data-structure substrate on the device, not a queue |
| Federated reasoning | An edge device becomes a sub-conductor when the cloud goes dark |
| Estate awareness | A persisted node snapshot answers “how is my network” with children unreachable |
| Messaging | Store-and-forward with custody transfer and contact-graph routing |
| Storage peers | An air-gapped peer is an absent edge, not a failed peer to retry |
| Data exchange | Signed offline bundles for catalog, policy, models and intelligence, verified on import, never trusted because they arrived |
| Writing software | A complete coding agent on the device (plan, edit, search, test, commit) reasoning on a local model with zero egress |
| The record | A hash-chained journal accumulates locally, and the fleet is told how far the backlog has grown |
So what
The honest headline is “nothing phones home to start”, which is test-verified, and “designed to keep working when the link does not.” Even at that bound, no cloud-first rival can put this table on a slide.
Thread 6
Signed at origin, and the signature travels
Provenance is attached at the moment of origin and verified at the moment of use, rather than asserted by a system of record in between.
| Artifact | Signed where |
|---|---|
| A captured frame | On the device, at capture, with content-provenance markings |
| An observation | Signed capture bundles from sensors |
| A model | Signed in the provisioning pipeline; an admission gate refuses an altered artifact at load |
| A policy | Signed by the issuing entity before it replicates |
| A job | A signed envelope addressed entity to entity |
| A workflow step | A cell-identity signature over input and output hashes |
| A code change | A signed, hash-chained diff receipt, verifiable offline |
| Semantics between cells | Signed chart projections, never raw vectors |
| A shared dataset | Compiled policy travels with it in a signed envelope |
| A clean-room run | Signed by the runner, output hashed and watermarked |
| A cell's configuration | An attestation signed by the cell itself |
| A licence | Ed25519, verified offline |
| A cell joining | A signed join-authorization bundle |
So what
The difference between “our database says this is the original” and “here is the signature, check it yourself.”
Thread 7
Everything is metered, attributed and verifiable
Consumption is attributable to an entity rather than to an API key, which is only possible because an agent is an entity.
| Metered | Attribution |
|---|---|
| Compute units by kernel class | Entity, workspace, cell, service group, node, organization, cost centre |
| Storage by peak gigabyte-month | The same dimensions |
| Function invocations | With the isolation tier as an attribute |
| Agent runs and inference | Per agent, per run, per workspace |
| Cryptographic operations | Metered like any other consumption |
| Clones, pipeline runs, notebook operations | Per operation |
| Zone, region and cross-zone transfer | By topology scope |
| The edge | Observed and governed, never billed as core consumption |
| Infrastructure count | Free and unlimited, cells, nodes and service groups cost nothing |
So what
Every line on your bill has a hash-chained record behind it that you can verify yourself, and you are never charged for the shape of your deployment. Split into twenty cells across five regions for residency and resilience: the topology costs nothing, only the work does.