Tenant and principal isolation
Every authenticated principal is bound to one tenant, one set of scopes, and a sensitivity ceiling. Gateway destinations come only from the private registry.
Security & privacy
Enforced controls, stated plainly, including what is not done yet.
The Trust Plane is a pilot runtime. It enforces a specific set of controls today and documents the production hardening a deployment still needs, rather than implying a wider guarantee than it can back up.
Enforced today
Approval separation
Approval decisions cannot be made by the requester. Handoff writes require the current lease owner and a fencing token, so a stale or expired lease cannot act.
Bounded inputs and outputs
Requests are validated against per-skill JSON Schema. Idempotency keys bind exact arguments. Upstream calls carry time and response-size limits.
SSRF and transport controls
Remote readiness and gateway requests reject embedded credentials, redirects, non-HTTPS endpoints, and private, loopback, link-local, or multicast addresses.
Context minimization
Context capsules use named transforms, allowlisted fields, prohibited-key checks, and public personal-data pattern checks, with expiry and revocation.
Tamper-evident audit
The event store is append-only and digest chained. /v1/audit/verify checks the chain independently of any single event.
Credentials and payments
API keys and agent credentials are compared as hashes; a raw credential is shown once and never re-displayed. Stripe processes payment details directly, the Trust Plane stores payment references and subscription state, not full card numbers. Live billing stays disabled unless every live configuration value is supplied together, and test and live credentials are kept in separate environments.
Public demonstrations stay synthetic
The bounded assessment accepts structured operating metadata only; it does not ingest repositories, message bodies, credentials, customer records, or private operational content. The self-service continuity proof and the CounselorAI and Breadcrumbs case studies on the Product page use synthetic fixtures or public, read-only checks. None of them read or modify a partner's production system, and none of them is presented as a claim about that partner's own security posture.
What a production deployment still requires
This pilot does not yet include: a validated multi-instance Postgres deployment, managed secret storage for API keys and upstream credentials, a fixed egress proxy for outbound traffic, cryptographic verification of signed agent cards, edge-terminated TLS with restricted origin access, a distributed gateway rate limiter, append-only external audit export, or routine dependency, container, SAST, DAST, and A2A conformance scanning in CI. Do not send FERPA, PHI, payment-card, credential, or similarly restricted data through the pilot store until those controls are in place for your deployment.
Your privacy choices
Signing in with Google shares only a provider-issued account identifier, not your Google password, mail, contacts, or files. See the full Privacy notice and Terms of Service for retention, sharing, and account-closure details.