⟦Cambiary⟧
Request a demo
Security & Trust

Governance you can point to in the architecture.

The AI runtime can never execute a side-effecting tool directly. It calls back through one gate that runs permission, policy, approval, and audit on every action — even across the service boundary. No bypass.

permission ∩ policy ∩ approval ∩ audit
The governance invariant

Ten controls, built into the boundary.

These aren't settings you can turn off — they're properties of where the code puts the gate.

The single governance gate

One choke point for every side effect; permission ∩ policy ∩ approval ∩ audit on every action, with no bypass, even across the Node↔Python language boundary. The AI runtime can never execute a side-effecting tool directly.

Least privilege, fail-closed

Effective permission = user ∩ agent ∩ org policy, and the default is deny. A sensitive tool with any missing input is denied rather than guessed.

Risk-tiered actions

Read-only runs automatically; controlled writes pause for approval; destructive actions are blocked. Risk level is declared per tool, not inferred at runtime.

Human-in-the-loop

Agents propose a plan and wait; approvals are explicit and scoped so authority can't leak across agent handoffs. Permissions are re-checked at each step.

Append-only audit, references only

Every governance decision is recorded using references and ids — never raw record content — so the trail is complete without becoming a second copy of your data.

Context minimization & privacy

The model only ever sees minimized references and counts. Boundaries block cross-record and cross-conversation mixing before a run; raw content is read only through governed tools.

Identity stays authoritative

The platform issues no identities of its own — your host token and adapter are the authority. It never becomes a second identity system.

Injection resistance

Authored instructions can't escalate privilege; injection attempts are evaluated at the governance boundary and gate at zero escalations in our test suite.

Host token vs service token

Two distinct tokens, never conflated: your host token (embed → Node, your app is the authority) and an internal service token (Node ↔ Python) that is constant-time compared and never logged or exposed to the browser.

Structured errors (RFC 7807)

Internal calls are authenticated with a constant-time-compared token; errors follow RFC 7807 problem-details and never leak internals or record content.

Honest posture

What we claim — and what we don't.

Certifications

No certifications are claimed here. We describe controls, not certification status. Ask the team for current posture.

AI models

OpenAI models today, selected under org and privacy allowlists with fail-closed selection if no approved model is available. Architected to add models over time — not a multi-provider claim.

Multi-tenancy

Single-tenant MVP today; tenantId threads through context, runs, audit, and host registration. Full per-tenant SaaS isolation is on the roadmap (Phase 2/3).

Security FAQ

Straight answers for a review.

Can the AI runtime execute an action directly?
No. The runtime never executes a side-effecting tool itself. It calls back through a single GovernanceGateway that runs permission ∩ policy ∩ approval ∩ audit on every action — even across the Node↔Python service boundary. This is a core invariant, not a configurable setting.
How are permissions decided?
Effective permission is the intersection of the user's permissions, the agent's allowed tools, and org policy, and the system defaults to deny. A sensitive tool with any missing input is denied rather than allowed. Read-only actions can run automatically; controlled writes pause for explicit human approval; destructive actions are blocked.
What does the audit trail store?
Every governance decision — the tool, the risk level, the outcome, who approved — recorded append-only using references and ids. It never stores raw record content, so the trail is complete without becoming a second copy of your data.
Does the model see our raw data?
Only minimized references and counts reach the model. Raw content is read only through governed tools, and boundaries block cross-record and cross-conversation mixing before a run executes.
Whose identity is authoritative?
Yours. The platform issues no identities of its own — it passes your host token to your adapter's validateToken, which is the real check. Your existing auth and permission systems stay the source of truth.
Are you certified (SOC 2, ISO 27001, etc.)?
We describe our controls, not certification status. Talk to our team for the current security posture and what a review looks like for your requirements.

Talk to us about your security review.

We'll walk the governance model and answer what's built versus roadmap — using an example close to your stack.

Request a demo Read the docs