How it works
Built to be checked by someone who does not trust us.
In one paragraph
Policy evaluation, evidence collection, and action gating run inside your tenant; there is no telemetry pipeline to PolicyCortex servers and no egress of evidence. Each record digest is SHA3-256 over the record content plus the previous digest, streams are append-only, and verification returns INTACT or the first sequence number where integrity fails. Absence is recorded as a declared gap.
- Execution boundary
- Your tenant
- Outbound telemetry
- 0 bytes
- SEQ0140state.capture
sha3:80e615afSealed - SEQ0141policy.gate
sha3:af192c60Verified - SEQ0142change.applied
sha3:mismatchFirst break - SEQ0143export.oscal
sha3:unresolvedInvalid
Where each component runs and what it can reach
Policy evaluation, evidence collection, and action gating happen inside your tenant. Nothing about your environment leaves it for us to work. There is no telemetry pipeline pointed at our servers, because a company whose product is proof should not be asking you to trust an outbound connection.
The boundary, stated as facts you can enforce with a network policy. For each component: where it runs, what it reaches, and what it cannot reach.
- collectors
- Run in your tenant. Reach your cloud control planes with read scope: Azure, AWS, and GCP, including GovCloud and GCC High. Cannot reach PolicyCortex; there is no endpoint on our side built to receive your telemetry.
- policy.engine
- Runs in your tenant. Reaches the evidence store and the recorded resource state, and evaluates every gate locally. Cannot phone out for a verdict: a gate that needs the internet to say no is not a gate.
- evidence.store
- Runs in your tenant. Append-only JSONL, SHA3-256 content hashes, hash chained per stream, seven-year retention, regenerable as of any historical timestamp. Cannot be edited in place: there is no update or delete verb, and a rewrite breaks every digest after it.
- decision.layer
- Runs in your tenant. Reaches the policy engine to request gate evaluation, proposes a captureState and restoreState pair, and publishes a confidence figure. Cannot execute directly: execution requires 3/3 gates plus the trust mode you set (SHADOW, GATED, AUTONOMOUS).
- export.surface
- Runs in your tenant. Reads the store to generate attestation artifacts: OSCAL 1.1.2 native, with SSP, POA&M, and SAR produced from one implementation record. Cannot write to the store: export has no write path by construction.
The only egress the product needs is from the collectors to your own cloud control planes. Deny everything else at the boundary and the product keeps working. That is a test, and we expect your network team to run it.
The chain, and what a break looks like
Each record's digest is SHA3-256 over the record content plus the previous record's digest. Records append to a per-stream sequence. That is the whole mechanism, and it is enough, because it makes editing loud: change one stored byte and the edited record's digest stops recomputing, and every record after it inherits the failure, since each prev field now cites a digest that no longer exists.
Verification does not return a feeling. It returns INTACT, or the exact record where integrity fails: the first broken sequence number, with everything after it invalid. Below, a three-record stream with a deliberate edit, and what verify says about it.
3 records checked · digests truncated to 12 hex chars
- SEQ0141Original record recomputes
Stored content and digest agree.
- Stored
- sha3:af192c60d7e4
- Previous
- sha3:be5507c1a92f
- SEQ0142Content changed after write
"deny-all-inbound" became "allow-any-inbound".
- Stored
- sha3:1d84f02c9a6b
- Recomputed
- sha3:c3907be215fa
- Previous
- sha3:af192c60d7e4
- SEQ0143The next link no longer resolves
Its prev field cites a digest that does not recompute.
- Stored
- sha3:88d1e4a20c5b
- Previous
- sha3:1d84f02c9a6b
Illustrative stream. The verification behavior is the product behavior.
A full day of state records with digests is on the state record. One change traced from detection to verified delta is on the change record.
- NIST 800-53
- AU-9 and AU-10: audit protection and non-repudiation as a mechanism you can rerun, not a narrative.
- NIST 800-171
- 3.3 audit and accountability, from the same store that maps all 110 requirements.
- FedRAMP 20x
- machine-readable evidence, OSCAL 1.1.2 exported natively from the chain.
Declared gaps: absence is recorded, not skipped
A collector down for six hours does not produce six hours of silence. It produces a gap record: which stream, from when to when, why, and when the gap was declared. Whoever reads the evidence later, including you, sees the hole and its shape instead of inferring it from row counts.
This is a design rule, not a feature, for one reason: evidence with fewer rows and no explanation is indistinguishable from evidence that was trimmed. If the record cannot say "we were not looking here, from then to then, because of this," then every quiet interval becomes an open question about the vendor. We would rather declare the gap and let you hold us to it.
{
"record_type": "declared_gap",
"stream": "aws.iam.role_state",
"from": "2026-07-03T09:12:44Z",
"to": "2026-07-03T15:12:44Z",
"reason": "collector_unreachable: credential rotation failed, retries exhausted",
"declared_at": "2026-07-03T15:13:02Z"
}
# hashed and chained like any other recordBecause gap records sit in the chain, a gap cannot be quietly removed later without breaking every digest after it. And when the store regenerates evidence as of any historical timestamp, the gaps regenerate with it. The absence is as durable as the presence.
The autonomy envelope
When the product acts without you, the authority for the action is written down before the action, not reconstructed after. That authority is the envelope: a bounded, operator-set object the policy gates evaluate at PRE-CHECK, before the decision layer's proposal can execute. Blast radius is capped by count. Confidence is published, not implied. 3/3 gates pass, or nothing happens.
Trust modes bound it further. SHADOW watches and executes zero actions. GATED, the default, puts a human approval on every action, scoped per action, per control class, per resource type, or per environment. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs the full sequence: capture state, execute, hash the state delta, roll back automatically on mismatch.
{
"allowed_action_types": ["tag.enforce", "storage.public_access.revoke"],
"blocked_action_types": ["identity.role.grant", "network.route.modify"],
"max_affected_resources": 25,
"min_confidence": 0.94,
"cost_ceiling_per_action": "50.00 USD",
"excluded_environments": ["production"],
"change_windows": ["Sat 01:00 to 05:00 UTC"],
"emergency_stop": "andon: any operator halts all autonomous classes",
"dry_run_first": "required for high-impact classes"
}The obvious objection: a log of what an agent did says nothing about what it was prevented from doing. Agreed. That is what the counterfactual is for. The agency record shows a blocked action next to what would have executed without the gate.
Verify it yourself
Request access so we can review your environment, verification goals, and onboarding scope. After access is approved, a read-only connection can produce state records and declared gaps inside your tenant, against your resources. In SHADOW mode, nothing executes. You can export those records and recompute the chain yourself.
Then put what it produced next to the specimen records on this site: what your cloud was, what changed it, and what your machines were allowed to do. If the audience for the output is an authorizing official, the federal record covers SSP, POA&M, and SAR generation from the same store, and where CMMC Level 2 and FedRAMP 20x fit.
What it does not do
Bring the person whose job is to disbelieve us.
Request Access