Product architecture
11 modules, and 2 services underneath every one of them
The platform exists to answer one question continuously, and each module owns a share of it: What AI agents exist, who owns them, what can they access, what can they do, what are they doing right now, and should they be allowed to do it?
The order matters. Visibility comes before enforcement, and enforcement comes before autonomy — a control plane that starts by blocking things it cannot yet see is a control plane nobody will leave switched on.
Reference flow
How a request travels
Discovery feeds the identity graph, the identity graph feeds policy, policy decides at runtime, and everything downstream of the decision becomes evidence.
- 01Enterprise environment
- 02Discovery and connectors
- 03Identity graph: agents, machines and credentials
- 04Policy engine
- 05Runtime enforcement
- 06Applications, APIs, data, MCP and tools
- 07Telemetry and evidence
- 08Audit ledger
- 09Forensics, compliance and risk
The modules
Each one answers a piece of the question
Agent Trust Discover
What AI agents exist here?
Find the AI agents, copilots, service accounts and machine identities already operating in the organization, without asking anyone to register them first.
Agent Trust Identity
Who owns each agent, and can it prove what it is?
Give every agent a machine identity that survives a model swap, a redeploy or a key rotation, and hold a named human accountable for it.
Agent Trust Machine Identity
Which non-human identities exist, and what are they holding?
Govern every identity that authenticates without a person present: workloads, service accounts, cloud roles, API clients, pipelines and the credentials all of them carry.
Agent Trust Access Governance
What is this agent allowed to reach?
Decide what an agent may touch, at the resolution of the individual action rather than the system.
Agent Trust Data Guard
What data may it see, combine and send outward?
Control which data an agent can access, join, process and move — including into an external model.
Agent Trust MCP Security
Which MCP servers does it use, and what do they grant?
Treat an MCP server as a privileged dependency: inventoried, risk-classified, approved, and watched for the capabilities it gains after approval.
Agent Trust Supply Chain
What is this agent built from, and what breaks if a piece does?
Maintain an AI bill of materials for every agent, and answer the blast-radius question before an incident forces it.
Agent Trust Runtime
What is it doing right now, and should this action be allowed?
Enforce the policy rather than document it: sit in the path of the action and allow, restrict, escalate, deny or quarantine it.
Agent Trust Forensics
What exactly happened, and how far did it reach?
Run every agent with a black-box recorder, so an incident is reconstructed from evidence rather than reconstructed from memory.
Agent Trust Assurance
Has it been tested, and is it still the version we approved?
Test an agent before production the way any other privileged system is tested, and re-test it when it changes.
Agent Trust Compliance
Can we prove any of this to an auditor?
Turn what the agents actually did into control evidence, continuously, instead of assembling screenshots once a year.
Foundations
Two services every module stands on
Nobody buys an audit ledger. But every module above is either asking the policy engine a question or writing to the ledger, so leaving them implicit would misrepresent the architecture.
Agent Trust Policy Engine
Under which rule was this decided?
One place where a decision is made, fast and deterministically, so authorization never waits on a model.
FoundationalAgent Trust Audit Ledger
What is the record, and can it be trusted?
Write every security-relevant event once, immutably, under a tenant, and keep it for as long as the customer must.
Delivery sequence
The order these are built in
Inventory and policy first, because everything after it depends on knowing what exists. Runtime enforcement second, because that is the point at which the platform stops being a document.
- Phase 1Inventory and policy
Tenancy, registry, ownership, permission inventory, risk scoring, policy engine, audit events, dashboards.
- Phase 2Runtime governance
The gateway, action-level policy, approvals, just-in-time access, the credential broker, behavioural monitoring.
- Phase 3MCP and supply chain
MCP registry and approval, tool inventory, AIBOM, dependency graph, supply-chain risk.
- Phase 4Data Guard
Classification, data-access policy, sensitive-data detection, egress and cross-system controls.
- Phase 5Forensics
Incident management, session timelines, blast radius, evidence preservation, kill switch, SIEM.
- Phase 6Assurance
The test framework, injection and permission tests, regression, certification, version reapproval.
- Phase 7Compliance
Framework mapping, continuous evidence, access reviews, audit packages, the trust centre.
- Phase 8Enterprise scale
Multi-org, delegated administration, residency, private deployment, regional enforcement.