A sealed box in front of the payment system
Your servers can ask. Only the box can release. They cannot reprogram it, and neither can anything that owns them.
Industries
Organizations that already run a vault next to a website.
We sell one gate at a time, to operators whose cost of an AI-driven compromise already exceeds the cost of a new stack. The first gate proves the boundary; every gate after it reuses the same appliance.
First gates
| Segment | The first gate we protect | Why it goes first |
|---|---|---|
| Digital-asset custody | Withdrawal authorization | These buyers already run HSMs and air gaps. The shortest cycle, and the first reference. |
| Banks and settlement | Wire release above a threshold; production-change approval | The operation with the clearest rulebook and the most expensive failure. Regulators already expect dual control. |
| Utilities and grid | A command gate in front of a SCADA or DCS zone | Physical consequence, independent sensors, and an existing safety-instrumented culture to build on. |
| Defense | Operator authorization for an autonomous or remotely commanded system | The traditions already exist in procedure and in nuclear-only hardware. This puts them in hardware on every platform. |
| Civil government | Privileged administrative actions on critical systems | The same standing-admin problem as a bank, with disclosure as the consequential effect. |
For banks
If an AI takes over your systems, your wires still follow your rules.
The appliance
The rulebook
Enforced every time, not asserted once
Who may send what, to which beneficiaries, up to what amount, how often, and until when. Changing the rules takes a stronger sign-off than using them.
The key
A press no software can make
Large wires need a press on a device that shows the real transaction on its own screen. A remote attacker cannot supply it.
With full control of your servers, an attacker still cannot:
×raise its own limits or add permissions
Grants live in the controller’s registry, not on the host. Delegation only shrinks.
×send to a beneficiary not on your list
The envelope names permitted recipients. Redirection is a different effect, and it is refused.
×exceed per-wire or daily amounts
Budgets are multidimensional and held in the controller’s ledger, which is the source of truth.
×replay or double-spend an approval
Every token is bound to one challenge, one domain and one short epoch, and is spent exactly once.
×press a key it does not hold
Presence is a physical action on a registered device. There is no software path to it.
For defense
The same authority model on a weapon platform.
An autonomy stack that can plan anything, and can act only inside the mission it was granted. A separate, ITAR-isolated line: it puts DoD Directive 3000.09’s requirement for human judgment over the use of force into hardware.
| Property | Bank gate | Defense variant |
|---|---|---|
| Effect | A wire, a production change, a record release | An engagement, a mode change, an emission, a maneuver class |
| Grant | Standing, per principal, renewed on a schedule | Mission-scoped, loaded before launch by a two-person ceremony, expires on its own |
| Presence | A press on a device in the data center | A load ceremony, and a commander’s lease-renewal device |
| Connectivity | Always connected | Disconnected, jammed, degraded: must work without reachback |
| Adversary access | Remote | Remote, plus physical capture of the platform |
| Failure mode | Fail closed | An engineered safe mode per platform: weapons safe, loiter, return to base |
Two-person rule for machines
Lethal effects require two independently built authority controllers to agree. The controller gates decisions, never the flight-control loop; latency and availability are part of safety.
Capture yields hardware, not authority
Grants are mission-scoped and expire, keys zeroize on tamper, and no platform carries a key that opens anything else.
Design partnerships
Tell us about the operation you would least like an attacker to perform.
The useful first conversation is narrow: one gate, its rulebook, who approves, and what currently stands between a compromised server and that effect. We will tell you honestly whether an independent boundary is the right answer for it.