Use Case
Compliance & Security
Security that satisfies your compliance team. RBAC, hash-chained audit logs, encrypted exports, and classification markings — designed for defense, critical infrastructure, and regulated industries.
Security at every layer
Control who sees what
Every action is performed by an identified principal — desktop user, LLM agent, or named service account — with a bitflag permission set and entity scope.
| Feature | What it does |
|---|---|
| Role-Based Access | 4 predefined roles (Admin, Operator, Viewer, ReadOnly) plus custom roles with permission inheritance |
| Entity Scoping | Restrict principals to all entities, specific regions, or named groups |
| Agent Permissions | LLM agents inherit the RBAC model — no special bypass, same policy engine |
Prove who did what and when
Every authentication attempt, command execution, policy decision, and data access is recorded with timestamps and chained SHA-256 hashes. Tampering with any record breaks the hash chain.
| Feature | What it does |
|---|---|
| Hash-Chained Logs | Each audit record includes SHA-256 of the previous record — tamper detection is built into the data structure |
| Command Lifecycle | Full tracking: Pending → Acked → Completed/Failed/Vetoed with policy engine rationale |
| AI Action Logging | Every LLM agent tool call captured with arguments, results, and the pattern that triggered it |
Protect data at rest and in transit
Credentials never touch disk unencrypted. All transport uses TLS 1.3 with mutual TLS support. Digital signatures verify data integrity.
| Feature | What it does |
|---|---|
| Encrypted Secret Store | age encryption with pluggable backends: memory (dev), file (single-node), env (containers) |
| Digital Signatures | Ed25519 EdDSA signatures on audit records and exports for non-repudiation |
| TLS 1.3 + mTLS | QUIC transport uses TLS 1.3 with 0-RTT resumption. Mutual TLS for service-to-service auth. |
Satisfy classification requirements
Exports carry classification markings, AES-256-GCM encryption, RSA-SHA256 signatures, and data watermarking for leak tracing.
| Feature | What it does |
|---|---|
| Classification Levels | UNCLASSIFIED, CONFIDENTIAL, SECRET, TOP SECRET — embedded in every exported file |
| Data Watermarking | Invisible watermarks in exports for leak tracing and attribution |
| Retention Policies | Per-recipient access control, delivery retry, and automatic purge after configurable retention period |
Ready to see the full picture?
One docker pull. Full stack in minutes. No build tools required.