Trust
What we can show, and what we don't claim.
We say Enforced only where a non-bypassable enforcement point is proven.
How it's built
- Agents propose. The credential for the target stays in the runtime bridge.
- Unknown or unclear means no: it fails closed.
- Each grant is single-use, short-lived and bound to one exact action.
- Evidence is append-only and hash-chained, and receipts are signed.
- Text from documents is treated as untrusted and never raises authority.
Demonstrable in a live walkthrough
- Versioned principals, agents and mandates.
- Approved and executed values, compared field by field.
- Single-use authority for one exact action.
- A real test-mode action, through to an independently checked receipt.
Not claimed yet
- No independent certification yet; testing is our own.
- No production customer evidence, so no enterprise-ready claim.
- No vendor partnership or endorsement, and none implied.
- Customers' own actions don't run against a real system yet: the web connector is in test.
Built on
AuthZEN-compatible policy consultation · Ed25519 signed receipts · SHA-256 hash-chained evidence · Independent receipt verifier · Signed approval-provider callbacks
Where it runs
Hosting and credential custody are agreed per deployment. The bridge that carries out actions can run in your environment, so the credentials for your systems stay with you.
Reporting a security issue
Write to avinash@delegrity.com with what you found and how to reproduce it. Please don't test against anyone else's data.