12 domains.
Including the ones we fail.

Overall coverage

Every party holds a VaultysId DID and proves possession of the key.

Identity is proven per connection by an SRP-style Challenger handshake — no bearer tokens, no shared secrets, nothing that works for whoever holds it. The public key observed during the handshake is persisted, so anything that Actor later signs can be re-verified offline with no live connection. Post-quantum identities (dilithium_ed25519) are a real, selectable type. Not present: mutual TLS with certificate pinning, and hardware-backed credentials for agents (humans can use real WebAuthn/FIDO2).

Attribute-scoped certificates resolved as a set — the strongest domain.

There is no role table. An Actor's permissions are the union of the signed CapabilityCertificate rows naming it as subject, resolved per action over the whole set by resolvePermission — which returns which specific certificate granted the action. CertScope narrows a grant to a resource, pattern, use count, or purpose, so a ten-second single-file grant is an ordinary auditable ledger row. Whether a human may open the admin console is decided by the same code path as whether an agent may read a file.

Workspace tenancy, per-kind capability allow-lists, and enforcing network interception.

Workspaces bound tenancy. Per-kind allow-lists are applied server-side at approval time, so a sensor cannot be granted system_command by any route — including a crafted form post. For the network dimension, the proxy Actor kind is an interception point that refuses agent traffic its signed rule set and certificate do not authorise. Not present: container or hypervisor isolation per agent, and per-workspace trust policy overrides.

One append-only trail that also drives every alert, so the two cannot disagree.

One recordEvent() call writes the audit row and drives the webhook and notification pipeline from the same sanitised payload — an alert cannot exist without a matching audit row. Entries carry DID attribution, field-level diffs, and a live-recomputed signature badge on certificate events, re-derived from the stored bytes rather than a stored flag. Honest limitation: the log is append-only by discipline, not by storage — rows are not signed or hash-chained.

Shadow-AI discovery is real; anomaly detection is not.

Endpoint sensors classify AI and agent workloads on real hosts and correlate them against the ledger — a workload whose identity evidence resolves to a known Actor is managed, one that does not is shadow. That is a genuine governance capability. But nothing establishes a behavioural baseline, nothing alerts on a threshold, and nothing contains an Actor automatically. Response is entirely manual revocation.

Closed protocol union and strict config parsing; the admin surface is uneven.

The WebSocket protocol is a small closed message union — unknown types are rejected, not routed — and configuration blobs are parsed by validators that reject malformed input rather than dropping it silently. The gap is the admin surface: it is Server Actions over DAOs with hand-written, non-uniform validation, and a known authorisation retrofit is still in progress because Next.js dispatches an action without re-running its route's layout gate.

Not built. Nothing inspects what an agent returns.

No partial credit here. Secret handling on the platform's own outputs is careful — encrypted keys are omitted at the query level, webhook payloads pass explicit allow-lists plus a recursive secret strip, generated secrets are revealed once — and capability gating limits what an agent can reach in the first place. None of that inspects agent output. Nothing scans a result for PII, credentials, or exfiltration patterns. This is the largest single gap in the assessment.

Deny by default, allow-listed per kind, and proven to gate on a real binary.

A capability an Actor does not hold authorises nothing, and every capability it does hold passed an explicit admin approval. The gate is demonstrably real, not asserted: the Go sensor logs that it is skipping its poll cycle until process_read is granted, reads no process information at all in that window, and begins polling in the same second the certificate exchange completes. Not present: rate limiting on tool calls, and per-tool sandboxing.

One vault primitive, write-only fields, and a confined decrypt capability.

Agents hold a private key, not a platform secret — there is nothing to leak in the agent path. Stored secrets (LLM provider keys, SSO client secrets, Apprise service URLs) all use one signcrypt-to-self primitive rather than several code paths, and the decrypt capability never leaves the control-plane process. Encrypted columns are omitted at the query level, not deleted after the fact. Not present: automatic rotation, external secrets managers, per-agent credential isolation.

Signed, offline-verifiable artefacts, and a decision function verified across two languages.

Both certificate formats are independently verifiable offline with no control-plane call. A proxy's rule set is signed at push time, deliberately leaving the stored copy unsigned since a stale signature is indistinguishable from a tampered one. The permission-resolution function exists in TypeScript and Go and both run the same committed conformance vectors — a divergence is a release blocker. Not present: automated rollback, configuration history for settings rows.

Out of scope for the control plane — and no credit claimed for it.

Agent memory is a property of the agent runtime, not the control plane, and this assessment does not claim credit for something a different process owns. What the control plane contributes: memory contents never transit it, because the chat and channel surface that would have carried them was removed, and there is no cross-Actor read path in the platform at all. Integrity verification, encryption at rest, and poisoning detection for stored memory are absent at every tier.

Shadow-AI visibility, a model inventory, and federation that binds to the trust model.

Governance uses the same mechanism as identity, so there is no separate engine to drift from the access model. Sensors surface unmanaged AI on real hosts; the Model Registry catalogues every sanctioned LLM endpoint; every change is audited and exportable. An SSO login that cannot be bound to a DID never produces a session — there is deliberately no 'signed in but not yet anybody' state. Stated plainly: model-workspace access is recorded and audited, but not enforced at inference time.