Core
Identity, policy, evidence, and the tamper-evident record every other capability stands on.
What changes for the organisation
One identity model, one policy model, one evidence vault, one tamper-evident record — for every capability you ever add.
How it works
Active Directory supplies identity and roles; a deterministic policy engine resolves who × what × where × action × override cost × evidence capture; evidence is encrypted under client-custody keys; every decision lands in an append-only, cryptographically chained event store.
What it watches
- Active Directory — users, groups, OUs, computer objects, multi-domain forests, RODC
- Every product event: capture, verdict, warn, override, block, FP mark, exception grant, admin action, evidence reveal, health change
- Signed offline bundles arriving on removable media — software, model weights, detector packs, destination catalog, report packs, policy templates
How it actually works
The mechanism, not the marketing. If a step below would not survive an engineer's scrutiny, it should not be on this page.
1
Identity is resolved, never stored
Kerberos SSO carries the AD identity into the console. Role tiers resolve to security-group membership at logon. Membership is cached with a configurable TTL so policy evaluation survives a domain-controller outage — and the resulting propagation lag is documented behaviour, not a surprise: a group change takes effect within the refresh interval.
2
A published policy compiles to a decision table
Who (group and OU SIDs) × what (detector class) × where (destination class) × action × override cost × evidence capture. Precedence is evaluated in one fixed order — exception, then rollout stage, then rule action — so identical inputs always produce an identical outcome, and the effective-policy viewer can replay it.
3
Nothing publishes without a dry run
The candidate version is replayed against a recent traffic window before it affects anyone: “this rule would have fired 213 times in the last 7 days.” Every publish is an immutable version with one-click rollback.
4
Evidence is sealed against the operator
Content is encrypted with a data key; the data key is wrapped by a key held in custody by the client's designated security officer. The platform sysadmin holds ciphertext and has no path to the wrapping key. Revealing evidence is a two-party ceremony, and the reveal is itself an event.
5
The record chains and signs itself
Each event is appended with a hash over its own payload plus the previous event's hash; the chain head is signed. An auditor exports and recomputes with their own tooling. Altering any event invalidates that link and every link after it.
6
Updates arrive on removable media
Bundle signature verified before install, staged, checked against the running endpoint version window, installed, health-validated, then committed or rolled back. Software, model weights, detector packs, destination catalog, report packs and policy templates all travel this way.
Operating path
From signal to auditable evidence
01Observed inputs
- Active Directory — users, groups, OUs, computer objects, multi-domain forests, RODC
- Every product event: capture, verdict, warn, override, block, FP mark, exception grant, admin action, evidence reveal, health change
- Signed offline bundles arriving on removable media — software, model weights, detector packs, destination catalog, report packs, policy templates
02Deterministic workflow
- 1 Identity is resolved, never stored Kerberos SSO carries the AD identity into the console. Role tiers resolve to security-group membership at logon. Membership is cached with a configurable TTL so policy evaluation survives a domain-controller outage — and the resulting propagation lag is documented behaviour, not a surprise: a group change takes effect within the refresh interval.
- 2 A published policy compiles to a decision table Who (group and OU SIDs) × what (detector class) × where (destination class) × action × override cost × evidence capture. Precedence is evaluated in one fixed order — exception, then rollout stage, then rule action — so identical inputs always produce an identical outcome, and the effective-policy viewer can replay it.
- 3 Nothing publishes without a dry run The candidate version is replayed against a recent traffic window before it affects anyone: “this rule would have fired 213 times in the last 7 days.” Every publish is an immutable version with one-click rollback.
- 4 Evidence is sealed against the operator Content is encrypted with a data key; the data key is wrapped by a key held in custody by the client's designated security officer. The platform sysadmin holds ciphertext and has no path to the wrapping key. Revealing evidence is a two-party ceremony, and the reveal is itself an event.
- 5 The record chains and signs itself Each event is appended with a hash over its own payload plus the previous event's hash; the chain head is signed. An auditor exports and recomputes with their own tooling. Altering any event invalidates that link and every link after it.
- 6 Updates arrive on removable media Bundle signature verified before install, staged, checked against the running endpoint version window, installed, health-validated, then committed or rolled back. Software, model weights, detector packs, destination catalog, report packs and policy templates all travel this way.
03Evidence outputs
- Versioned event schema with actor as SID + sAMAccountName, machine as AD computer object, policy version in force, and evidence reference or none
- Syslog/CEF export to on-premises SIEM — Splunk, QRadar, ArcSight, Wazuh. No cloud-SIEM assumption.
- Tamper-evident chain, verifiable by auditor-role export
A case
“Prove to me that nobody altered the record.”
The question an auditor asks that most products cannot answer, because an audit log without integrity protection is worth nothing to a regulator.
Request
The auditor exports events #000001–#004417 with the signed chain head, using their own read-only role. No administrator is involved in producing the export.
Recompute
They recompute the chain independently. The platform is not asked to verify itself — that would be the whole problem.
Divergence
Recomputation matches until #000414, then diverges. One event's payload had been altered directly in the database, bypassing the application.
Localisation
Because each link binds to the one before, the tampering is pinned to a sequence number and a timestamp window — not merely “something changed.”
Attribution
The admin-action and evidence-reveal logs for that window name who held database access. Those entries are themselves chained.
What it came to
The record did not prove itself trustworthy. It proved exactly where it stopped being trustworthy, which is the only thing a regulator can actually use.
How a decision gets made
The authority ladder. Green rungs are authoritative — a rule, a scanner, a sandbox, or a person. Blue is where the model contributes. Amber is where a human decides.
03
Evidence
Captured content encrypted at rest under keys held by a client-designated security officer — not by the platform sysadmin.
04
Record
Append-only, chained, signed. Any mutation is detectable by an auditor-role export.
What the model adds
Nothing. M0 contains no model on any decision path. It is the deterministic substrate the AI capabilities are governed by.
What it cannot claim
Not applicable — there is no inference in the platform core.
What it will never do
- Never stores a user or a role of its own — identity comes from Active Directory, always.
- Never phones home. There is no outbound path to disable, which is why the claim is verifiable by your own network monitoring.
- Never lets the Platform Sysadmin read evidence content. Blindness is enforced cryptographically, not by UI permission.
- Never silently expires. On licence expiry it degrades to warn-and-log with prominent alerting; it does not brick and it does not hard-stop user work.
What evidence it leaves
- Versioned event schema with actor as SID + sAMAccountName, machine as AD computer object, policy version in force, and evidence reference or none
- Syslog/CEF export to on-premises SIEM — Splunk, QRadar, ArcSight, Wazuh. No cloud-SIEM assumption.
- Tamper-evident chain, verifiable by auditor-role export
- Per-user event export for data-subject access requests
See it work
Status and what promotion requires
Committed v1 scope. Shipping.
Roles that touch it
Policy AdminSOC AnalystAuditor / CompliancePlatform SysadminSecurity Officer / Key Custodian