---
title: "How it works: an architecture built to be checked"
description: "Component boundaries, the SHA3-256 hash chain, declared gaps, and the autonomy envelope. Everything runs inside your tenant, and you can verify it read only."
url: https://policycortex.com/architecture
sealed: 2026-08-31
amended: 2026-09-05
register: architecture
records: 6
digest: sha3:68df77187d850e052e12d9f803e1c4c2f22d6b7dd0de664d82571e7576b8e6b3
---

# Built to be checked by someone who does not trust us.

How it works

See where each component runs, how evidence is linked, and how missing observations are recorded. Verify the system without granting us write access.

**In one paragraph.** Policy evaluation, evidence collection, and action gating run inside your tenant; there is no telemetry pipeline to PolicyCortex servers and no egress of evidence. Each record digest is SHA3-256 over the record content plus the previous digest, streams are append-only, and verification returns INTACT or the first sequence number where integrity fails. Absence is recorded as a declared gap.

[Request Access](https://app.policycortex.com/auth?mode=request-access) · [Skip to how you check us](#verify)

## Where each component runs and what it can reach

Policy evaluation, evidence collection, and action gating happen inside your tenant. Nothing about your environment leaves it for us to work. There is no telemetry pipeline pointed at our servers, because a company whose product is proof should not be asking you to trust an outbound connection.

The boundary, stated as facts you can enforce with a network policy. For each component: where it runs, what it reaches, and what it cannot reach.

- **collectors**: Run in your tenant. Reach your cloud control planes with read scope: Azure, AWS, and GCP, including GovCloud and GCC High. Cannot reach PolicyCortex; there is no endpoint on our side built to receive your telemetry.
- **policy.engine**: Runs in your tenant. Reaches the evidence store and the recorded resource state, and evaluates every gate locally. Cannot phone out for a verdict: a gate that needs the internet to say no is not a gate.
- **evidence.store**: Runs in your tenant. Append-only JSONL, SHA3-256 content hashes, hash chained per stream, seven-year retention, regenerable as of any historical timestamp. Cannot be edited in place: there is no update or delete verb, and a rewrite breaks every digest after it.
- **decision.layer**: Runs in your tenant. Reaches the policy engine to request gate evaluation, proposes a captureState and restoreState pair, and publishes a confidence figure. Cannot execute directly: execution requires 3/3 gates plus the trust mode you set (SHADOW, GATED, AUTONOMOUS).
- **export.surface**: Runs in your tenant. Reads the store to generate attestation artifacts: OSCAL 1.1.2 native, with SSP, POA&M, and SAR produced from one implementation record. Cannot write to the store: export has no write path by construction.

The only egress the product needs is from the collectors to your own cloud control planes. Deny everything else at the boundary and the product keeps working. That is a test, and we expect your network team to run it.

## The chain, and what a break looks like

Each record's digest is SHA3-256 over the record content plus the previous record's digest. Records append to a per-stream sequence. That is the whole mechanism, and it is enough, because it makes editing loud: change one stored byte and the edited record's digest stops recomputing, and every record after it inherits the failure, since each prev field now cites a digest that no longer exists.

Verification does not return a feeling. It returns INTACT, or the exact record where integrity fails: the first broken sequence number, with everything after it invalid. Below, a three-record stream with a deliberate edit, and what verify says about it.

A full day of state records with digests is on [the state record](https://policycortex.com/proof/state). One change traced from detection to verified delta is on [the change record](https://policycortex.com/proof/change).

- **NIST 800-53**: AU-9 and AU-10: audit protection and non-repudiation as a mechanism you can rerun, not a narrative.
- **NIST 800-171**: 3.3 audit and accountability, from the same store that maps all 110 requirements.
- **FedRAMP 20x**: machine-readable evidence, OSCAL 1.1.2 exported natively from the chain.

## Declared gaps: absence is recorded, not skipped

A collector down for six hours does not produce six hours of silence. It produces a gap record: which stream, from when to when, why, and when the gap was declared. Whoever reads the evidence later, including you, sees the hole and its shape instead of inferring it from row counts.

This is a design rule, not a feature, for one reason: evidence with fewer rows and no explanation is indistinguishable from evidence that was trimmed. If the record cannot say "we were not looking here, from then to then, because of this," then every quiet interval becomes an open question about the vendor. We would rather declare the gap and let you hold us to it.

Because gap records sit in the chain, a gap cannot be quietly removed later without breaking every digest after it. And when the store regenerates evidence as of any historical timestamp, the gaps regenerate with it. The absence is as durable as the presence.

## The autonomy envelope

When the product acts without you, the authority for the action is written down before the action, not reconstructed after. That authority is the envelope: a bounded, operator-set object the policy gates evaluate at PRE-CHECK, before the decision layer's proposal can execute. Blast radius is capped by count. Confidence is published, not implied. 3/3 gates pass, or nothing happens.

Trust modes bound it further. SHADOW watches and executes zero actions. GATED, the default, puts a human approval on every action, scoped per action, per control class, per resource type, or per environment. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs the full sequence: capture state, execute, hash the state delta, roll back automatically on mismatch.

The obvious objection: a log of what an agent did says nothing about what it was prevented from doing. Agreed. That is what the counterfactual is for. [The agency record](https://policycortex.com/proof/agency) shows a blocked action next to what would have executed without the gate.

## Verify it yourself

Request access so we can review your environment, verification goals, and onboarding scope. After access is approved, a read-only connection can produce state records and declared gaps inside your tenant, against your resources. In SHADOW mode, nothing executes. You can export those records and recompute the chain yourself.

[Request Access](https://app.policycortex.com/auth?mode=request-access)

Then put what it produced next to the specimen records on this site: [what your cloud was](https://policycortex.com/proof/state), [what changed it](https://policycortex.com/proof/change), and [what your machines were allowed to do](https://policycortex.com/proof/agency). If the audience for the output is an authorizing official, [the federal record](https://policycortex.com/federal) covers SSP, POA&M, and SAR generation from the same store, and where CMMC Level 2 and FedRAMP 20x fit.

## What it does not do

**Stated limit.** PolicyCortex observes the clouds you connect: Azure, AWS, and GCP, including GovCloud and GCC High. What is not connected is not observed, and the record says so rather than implying coverage it does not have. And it is software plus an engagement, not an assessor: it produces the evidence and the artifacts an assessment consumes. It does not sign the assessment.

Bring the person whose job is to disbelieve us. [Request Access](https://app.policycortex.com/auth?mode=request-access)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | BOUNDARIES | 2894f7e64ebd | d09358cda6a0 |
| REC 0001 | CHAIN | 303f2c6dc267 | 2894f7e64ebd |
| REC 0002 | DECLARED GAPS | d5cef1b56b3b | 303f2c6dc267 |
| REC 0003 | ENVELOPE | 4a7ffbe9e22b | d5cef1b56b3b |
| REC 0004 | VERIFY | 46d255b5587c | 4a7ffbe9e22b |
| REC 0005 | STATED LIMIT | 68df77187d85 | 46d255b5587c |

Head sha3:68df77187d850e052e12d9f803e1c4c2f22d6b7dd0de664d82571e7576b8e6b3. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.