Identity
Verify the workload
Establish the principal and session through a trusted identity source. Reject expired, revoked or mismatched context.
Zero trust
Authority must be explicit.
Zero trust informs how we are building AI security: verify identity, limit permissions and reassess authority at the boundary where an action occurs.
The work
Trust is scoped to a specific action.
Treat AI-generated content as input to the security decision. It cannot grant itself permissions or approve its own work.
Least privilege
Bind the permission
Use an explicit environment, resource, action and model version. Ambiguous grants and missing evidence must deny a new proposal.
Human control
Bind consequential approvals
Keep approval separate from the proposing workload. Tie it to the exact action and policy, with expiry and revocation.
Development status
The work behind the direction.
The product is in private development. App access and live security enforcement are not available.
- Private developmentAccess and action policies
- A tested policy core checks exact permissions, identity freshness, model bindings and separate human approval. Live enforcement is not connected yet.
- Private developmentRecorded evidence review
- A local evaluator checks supported task reports against reviewed criteria. It identifies conflicting states and missing evidence within the supplied recording.
- Integration workTrusted system integrations
- Identity providers, artifact verification, approval services and execution boundaries must be connected to the system being secured.
- ResearchAI-specific threat testing
- Adversarial inputs, sensor attacks, poisoned data and compromised models need their own threat models, test data and controls.
What comes next
A policy decision needs an enforcement boundary.
The private core is one component. A live security system also needs trusted context, controlled dispatch and operational testing.
Integration
Keep trusted context separate
An identity or attestation adapter supplies verified context. A request body cannot assert that a workload is trustworthy.
Execution
Prevent approval reuse
Recheck the current policy and consume approval atomically before dispatch. A previously returned permit is not a reusable execution token.
Operations
Design for the environment
Define outages, revocation, safe operating boundaries and independent controllers with the system owner.