Autonomy, but not a black box.
Every automated IAM tool either runs on rails (dashboards + checklists) or dispatches opaque agents you're asked to trust. We reject the second and improve on the first. Every defense below is code you can read, policy you can edit, and a log line an auditor can verify.
Attestation before execution. Zero blind trust.
Before any account state changes, the Gatekeeper distills intent, OPA evaluates tenant Rego, and Vault signs the payload. The Doer Agent receives an immutable contract that fails closed if a single bit is modified.
{
"intent_id": "int-7f9a2b1c8e",
"timestamp_epoch": 1789124400,
"target_identity": "jane.smith@enterprise.io",
"action": "deactivate_and_revoke",
"portals": ["okta", "google_workspace", "github", "slack"],
"policy_evaluation": {
"engine": "open_policy_agent_v0.68",
"rego_hash": "sha256:4b9e2f01...",
"decision": "ALLOW_SOFT_PHASE",
"risk_score": 0.12,
"requires_hitl": false
},
"signer": "gatekeeper.production.internal",
"signature": "hmac-sha256:9a4f8c2e...[VAULT_KEY]",
"lease_ttl_sec": 60
}{
"block_height": 14209,
"prev_block_hash": "a1b2c3d4e5f67890...",
"merkle_root": "8f7e6d5c4b3a2109...",
"current_hash": "e3b0c44298fc1c149afbf4c8...",
"action_taken": "soft_deactivate",
"hard_delete_scheduled": "2026-09-20T22:45:00Z",
"defer_window_sec": 300,
"reinstate_eligible": true,
"tamper_detected": false
}curl -s https://zero-trust.internal/audit/verify?tenant=acme | jq .
What's between an LLM and your production directory.
Every action passes OPA.
Rego policies are code you own — version-controlled, code-reviewed, deployed alongside the rest of your infrastructure. Allow, deny, require-HITL, block. Every packet the executor receives is signed with a per-tenant HMAC-SHA256 key; unsigned packets fail closed at the doer.
The risky 5% routes to an approver.
Privileged accounts, production owners, HRIS disagreement, recent escalations — anything that crosses your risk threshold fires a one-time signed approval link to your security team's Slack. Approve or reject with cryptographic attribution; the actor identity makes it into the audit chain.
Tamper-evident by design.
Every decision, every execution, every credential lease emits a SHA-256-chained event to a write-once ledger. SOC 2, SOX and ISO 27001 auditors verify the chain themselves with a single endpoint — you don't have to trust us.
What we explicitly defend against.
We treat incoming text as untrusted attacker input, administrative API tokens as transient liabilities, and SaaS deprovisioning as a reversible two-phase transaction.
Prompt Injection & Schema Hijack
Attacker attempts prompt manipulation, role-shift instructions (“ignore previous instructions”), or nested JSON schema injection in inbound Slack, Teams, or HR tickets.
Deterministic AST post-filter executes before pipeline evaluation. Detection clamps parse confidence ≤ 0.4, scrubs target identity from packet, flags prompt_injection_suspected, and forces human security review.
SaaS Credential Exfiltration
Adversary penetrates a worker node or inspects process memory attempting to extract persistent admin credentials for Okta, Azure AD, Slack, or GitHub.
The executor never holds long-lived tokens. HashiCorp Vault generates dynamic 60-second JIT leases per action and revokes them immediately post-execution. Path-isolated tenant mounts eliminate cross-tenant leakage.
Rogue Dispatch & MITM Payloads
Compromised network entity or unauthorized internal service attempts to forge offboarding dispatch messages to revoke employee access without OPA policy checks.
Gatekeeper signs decision packets with per-tenant HMAC-SHA256 secrets stored in Vault. The Doer verifies signatures on both HTTP and Kafka paths. Mismatched packets emit doer.signature_rejected and fail closed.
Erroneous Termination & Accidental Delete
Mistaken departure ticket submitted for an active executive or infrastructure on-call engineer, threatening immediate company-wide service interruption.
Two-phase commit. Soft phase (account suspension + session revocation) is instant. Permanent hard deletion (user purge + license reclaim) defers 5 minutes. A single POST /reinstate in the window restores all systems.
The non-negotiable trust boundaries.
True enterprise security is defined by what a system refuses to do. These four architectural constraints are baked into the core engine.
The stack runs in your VPC.
We do not store or hold customer SaaS master credentials. Long-lived tokens reside exclusively in a HashiCorp Vault instance deployed into your cloud infrastructure, with strict rotation runbooks and 60-second JIT leases. On Done-for-You, you can revoke our access at any second.
No open-ended agent loops.
We do not run unconstrained “general autonomous agents” that can hallucinate or take arbitrary actions. Every identity pipeline — joiner, mover, leaver, access review — is a finite state machine with deterministic transitions and a deny-by-default OPA policy gate.
No web UI policy editing.
Security rules cannot be modified or bypassed from an operator dashboard. All Rego policies are version-controlled in your Git repository, tested with opa test in CI, and deployed alongside the rest of your infrastructure via pull request.
Zero phone-home beacons.
No telemetry beacons, no user tracking, no phone-home analytics. The only outbound network traffic originating from a tenant deployment is the direct, encrypted API requests sent to your explicitly configured SaaS portals.
Control mapping for auditors.
How the implemented controls map to the evidence requirements of SOC 2 Type II, SOX 404, ISO 27001, and NIST SP 800-53. Controls implemented; certification on the roadmap — not yet held.
Verifiable least-privilege credential access, timely offboarding revocation, and tamper-evident event trails for external auditor sampling.
Cryptographic segregation of duties between the policy gatekeeper and API executor; write-once audit records prevent retro-active log alteration.
Immediate removal of access rights upon contract termination, with cryptographic non-repudiation timestamps and human approver identities.
Automated removal of accounts within 5 minutes of departure notice; zero persistent credential storage; dynamic least-privilege JIT elevation.
Read the security primitives.
The OPA policies, the packet-signing implementation, and the WORM audit chain — published under a source-available evaluation license. Clone the repo, run opa test policies/ against the production-identical policies, audit the code yourself before you sign anything.