Govern what AI agents may do. Prove what they did.

Proven today

Committed evidence on the main branch — runnable, or exercised by CI. Items marked supported exist but their guarantee depends on how the operator deploys them.

• Gate-first MCP accountability gateway on tools/call — stdio and Streamable-HTTP self-host
• Operator-delegated capability grants with hard ceilings, evaluated default-deny
• Allowed before execution; blocked before the call reaches the downstream tool
• The downstream tool's own log corroborates that a blocked call never arrived
• Signed, hash-chained receipts for allow and block alike, on a Merkle transparency log
• A standalone verifier that shares no code with the server, pinning two separate anchors — the witness key and the ceremony-sourced receipt-issuer key
• Tamper negative control — one flipped byte makes verification fail
• Bounded assignment enforcement on the stdio gateway — one agent, one run, one time window: expiry, revocation, agent/run binding, explicit tool denial, grant-id integrity, and a restricting operator-policy overlay, all fail-closed
• An append-only, hash-chained external STH mirror that detects history rewrite, equivocation, rollback, and mirror tampering once a signed tree head has been mirrored
• Application-layer organization scoping in the Human Plane (organizations, members, roles, invitations, projects, agents, resources) — supported, environment-gated
• Durable Postgres and file evidence ledgers, root-authority custody, and replay-nonce continuity — supported, self-host, selector-gated, exercised by CI
• Committed, reviewable Human-Plane SQL migrations and a provider-neutral PostgreSQL row-level-security isolation substrate — merged and exercised by CI; no shipped code applies the migration or switches the application to a non-owner role, so nothing here puts the policies in force, and this program has applied no production migration
• Adversarial cross-tenant isolation and schema-parity proofs running in CI against a disposable PostgreSQL instance
• A transaction-local tenant principal context, designed to receive an already-verified identity — the Wave-2A identity boundary that supplies one has merged, and Wave 2B has since opened that context on the live request path for the converted routes; switching row-level security on is a separate, unbuilt step no shipped code performs
• A per-request Human-Plane corridor — Track B, Wave 2B PR-1…PR-5: nine read routes and thirteen tenant-scoped mutations execute their storage calls inside one transaction carrying the tenant principal, with the organization-family audit written in that same transaction. Merged and exercised by CI. Carrying the principal is not enforcing a policy: this code switches on no row-level security and applies no migration
• A provider-neutral identity boundary — Track B, Wave 2A: an opaque, permanent Magenta user identifier and a provider-agnostic identity adapter, merged and exercised by CI
• Verified-email invitation authority bound to the identity record rather than to a mutable profile field
• A forward-only Human-Plane identity migration with a definer-owned resolve-or-provision function, and its committed identity-boundary suite
• First-fact primitives wired and their two routes converted — Track B, Wave 2B PR-6: organization creation and invitation acceptance are single definer-owned database calls, and the application holds no second temporal model of verified-email authority. Merged and exercised by CI on canonical main. It switches on no row-level security and applies no production migration

Building now

Work under way that this page does not represent as proven — not production-active, not available to run, and not to be relied upon. Ordinary active development and work that is complete and awaiting authorization both sit here. This column takes NO position on whether any item's branch has merged; each item's declared lane lifecycle is where that is recorded, and only the Proven column speaks to canonical main. Nothing occupies this state right now.

Next

Roadmap. Not built. Not to be relied upon.

• Runtime row-level-security activation on the live request path, behind a runtime mode and startup admission — Track B, Wave 2B PR-7
• Retirement of ordinary direct member addition, once invitation acceptance is the seated path — Track B, Wave 2B PR-8
• Production identity-provider selection and activation
• Hosted multi-tenant operation and a managed customer control plane
• Subscription, entitlements, and billing as a commercial-access boundary
• Managed KMS / HSM key custody
• A hosted, managed, independently operated third-party mirror service (the mirror mechanism itself is proven today; what is missing is independent operation of it)
• Per-request runtime enforcement of assignment authority on the HTTP transport, which today refuses to start rather than run an assignment it cannot enforce
• A wired human-approval path, so a require-review decision can become an approval instead of a refusal