Security review pack
Everything your reviewer will ask, answered on one page.
Not a status dashboard. A reviewer wants answers they can paste into a questionnaire and a list of what is enforced where, so that is what this is. Take it away, send it on, come back when you have questions it does not answer.
The control registry
Sixteen controls. Every one is a switch with a name.
This is the actual registry the product enforces against, not a marketing summary of it. Each control appears in the console’s own Security Posture view at its current value on your node, and a control that is not on this list does not exist for the operator.
| Control | What the hardened setting does |
|---|---|
| Operator auth gate | Requires a real login before any operator surface is reachable. |
| Agent runtime | Runs the agent loop in an isolated process plane rather than inside the secret-holding application. |
| Permission mode | Governs whether a step may act without asking. Prod posture is not the permissive default. |
| Agent sandbox | Binds a step into a kernel sandbox holding one workspace tree; other tenants and the object store are outside it. The hardened value is the sandbox; anything else is a development relaxation. |
| Command scan | Blocks shell calls matching credential-theft, exfiltration, privilege-escalation and cross-tenant path patterns. The relaxed setting observes without blocking. |
| Prompt scan | Sanitises untrusted content before it is inlined into a prompt. |
| Prompt scan on ingest | Applies the same scan at upload, so a poisoned document is caught before it is ever read. |
| Gateway DLP | Inspects outbound content at the egress gateway. Hardened settings block or redact; the relaxed setting only observes. |
| Legacy ciphertext | Refuses ciphertext that is not bound to its context. Turning this off is a documented migration state, not a posture. |
| Hard cost cap per run | A dollar ceiling that halts the run. Off is treated as needing attention everywhere, including locally. |
| Subagent cap | Caps how many workers one session may spawn, so a recursive fan-out cannot run away. |
| Turn ceiling | Caps turns per step, so a loop terminates without a human noticing it. |
| Subagent tools | Controls which tools a spawned worker may reach at all. |
| Model provider | Which inference path is active, and therefore where your text goes and under whose terms. |
| Subscription model auth | Whether a consumer-subscription auth path is permitted. Enterprise posture is no. |
| Bedrock credential path | Governs whether a cloud bearer token may reach a job environment. |
The console grades each row hardened, dev-relaxation, or needs-attention, and reports one overall verdict. We show you that view on your own node rather than publishing ours: a screenshot of someone else’s posture tells you nothing about yours.
Beyond the switches
The parts a registry cannot show.
A toggle list is what an operator reads. These are the properties underneath it: how an agent is contained, how the record leaves the box, and what happens when something goes wrong or you walk away.
| Property | What it means on your node |
|---|---|
| Agents are contained | Every agent runs in a separate runner container, unprivileged, in a kernel jail bound to one workspace read-write and the platform read-only, with its own private temporary space and a system-call profile. A production build refuses to start with the agent inside the application. |
| Plans are signed with a key | A plan’s signature is keyed to your node, so a plan or a specialist edited outside the console fails verification before a run rather than after it. |
| The record leaves on your terms | A date range exports the signed audit trail as one file with a checksum, ready for your own archive or write-once storage. Your workspace exports as a single signed archive: files, plans, transcripts and the ledger. |
| Backups are proven, not promised | Backups run on a timer, and a restore drill boots a copy of the running image on the restored data with no network, checks readiness and decrypts a stored credential, so the backup is known to work before you need it. |
| Releases roll and roll back | One signed image, shipped by digest inside your maintenance window, with the previous digest recorded first so a rollback is one command. The running version and build are on the health endpoint. |
| The supply chain is pinned | Every dependency is locked and hash-checked, base images are pinned by digest, and each build publishes its third-party notices and a bill of materials. |
| People are named | Roles, invitations and two-factor sign-in; each surface and action checked against the operator’s role; every approval, signature and run attributed to a person. |
| Leaving is a procedure | Your export first, then an ordered teardown that ends in a written destruction certificate. |
The questions reviewers actually ask
Can a specialist read outside its workspace?
- No. An unpinned read is refused rather than filtered, traversal is blocked, and the sandbox binds a step to one tree. Cross-tenant paths are caught by the command scan as well.
Where does a provider key live?
- In the vault. It is added to the outbound request at the egress gateway, so it is never in a prompt, a transcript, or a log. A fixed list of platform secrets can never reach a child process at all.
Can the audit trail be edited?
- Each entry hashes its predecessor. Reorder, delete or edit one and verification names the first broken entry. Entries can be signed, and a daily append-only file is kept as a second sink.
What happens on a data-subject request?
- A per-run erase removes the transcript without breaking the chain.
What stops a runaway cost?
- A dollar ceiling per run that halts rather than warns, plus a cap on concurrent workers and a turn ceiling per step. A pre-run estimate is shown before approval.
Who can approve what?
- A named human, and what an approval may do is a closed vocabulary the agent cannot extend. Tokens are single-use and expire with the proposal.
How do releases reach a box?
- One image, built and signed by the pipeline and verified on deploy. Only git reaches a host. The node refuses to boot on a missing secret or an unmigrated schema.
Where does our data live?
- Your servers. Run bundles are envelope-encrypted at rest and model access runs through your own provider account, under your terms.
Can we see the audit trail in our own systems?
- Yes. A date range exports the signed trail as one file with a checksum, which lands in your own archive or write-once bucket; it also ships beside every backup.
Who can approve a change?
- A named operator with the right role. Asking and approving are separate acts, and a node can require a second person for anything that reaches a private system or needs a secret.
What happens when we leave?
- You get a signed archive of the workspace: files, plans, transcripts, the ledger. Then an ordered teardown, ending in a destruction certificate.
Dated evidence
| August 2026 | A reference node has run the full stack on AWS since August. It is cycled off and on to hold cost down during development. |
| Through September 2026 | Four adversarial engagements this year, all run in-house with specialists forged for our own codebase, the most recent on 16 September, each with its raw findings and a line-by-line disposition on the record. Because plans are repeatable and schedulable, the same red-team review runs again as continuous monitoring. No third-party penetration test has been done yet; the summary a tester would be handed says so in the first paragraph. The plan that ran one of them is published. |
| September 2026 | A pack written outside the platform, carrying plans, specialists and an integration to a private database, was uploaded, reviewed, approved, signed and run end to end, with the platform image carrying none of it. |
| September 2026 | A restore drill boots a copy of the running image on restored data, with no network, and decrypts a stored credential; a release rolls and rolls back by digest. |
| September 2026 | Releases ship by signed, verified digest, and the pipeline’s own pre-flight caught two misconfigurations before any user did. |
Controls in the registry
16
Grants to an unsigned plan
0 by construction
Audit events attributable
100 percent
Security pillars in code
10 of 10
What we will not do
Publish a live dashboard of our own node and call it yours.
A posture page showing our numbers proves nothing about your deployment, and a page of illustrative values dressed as live ones is worse than no page. The console has the live view; it reads your node, and we will open it in front of you on a call.
Write to the assistant inbox
assistant@agenticensemble.ai