Skip to content
HALTSEAL • Pre‑action control for agentic AI

# Verifier → Permit → Fail‑Closed Gateways

Block egress / device I/O / accelerator dispatch until a verifiable, scoped, expiring permit exists — with audit‑ready receipts.

Download deck (PDF)
1‑pager (PDF)Contact security
Why now Security boundary

### Model output becomes action

Agentic systems create “allow‑by‑default” failure modes under drift, misconfig, or bypass. HALTSEAL enforces pre‑action control.

The posture Fail‑closed

### No permit, no side effect

Missing/stale/unverifiable prerequisites → HOLD/DENY and the action is blocked at non‑bypassable chokepoints.

Proof artifacts Buyer‑facing Exportable

### What you can verify

- Signed log head + freshness policy
- Inclusion + consistency proofs (append‑only evolution)
- Signed, audience‑bound, expiring permit token
- Immutable receipt record (append‑only ledger)
- Deterministic dispositions + readable reason codes

Procurement kit Claim themes

## Architecture (3 control primitives)

Simple to explain. Hard to bypass.

Download deck (PDF)
1 Verify‑to‑Activation

### Freshness + inclusion + consistency

Runtime validates that the committed deployment logic is included under a current signed head and that the log evolved append‑only.

2 Permit‑before‑Action

### Mint only after PASS

On PASS, mint a short‑lived permit bound to audience (agent/tenant/mission), record a receipt, and require it at execution time.

3 Fail‑Closed gateways

### Enforce at chokepoints

Gateways require a valid permit identifier before network egress, device I/O, or accelerator dispatch — otherwise fail closed.

## Where enforcement lives

Non‑bypassable chokepoints. Pick one for a pilot.

Control points Non‑bypassable

- Kernel egress / dispatch intercept (syscall paths, cgroups/eBPF, network gateways)
- Driver path (queue/doorbell before device or accelerator action)
- Firmware / microcode (before dispatch)
- Hypervisor intercept (VM‑exit / egress gateway)

Security invariants Tested

- Fail‑closed default: missing permit → DENY
- Revocation overrides allow (immediate + provable)
- TTL enforced (short‑lived permits)
- Bypass attempts (loopback/proxy) deterministically denied

## The 60‑second proof

What we show in the meeting — optimized to earn the security‑attended deep dive.

1
No permit → DENY (fail closed)
2
Bypass attempt (loopback/proxy) → DENY
3
Verifier mints permit → permit installed
4
TCP/UDP egress → ALLOW (in scope)
5
Revocation overrides allow → DENY
6
TTL expiry → DENY

### Meeting outputs

A short report plus machine‑readable receipts (e.g., JSONL) and readable deny reasons — designed for Security review.

Procurement kit Contact security

### Buyer‑run Pilot (30 minutes, self‑serve)

Run a fail‑closed gateway locally. No meeting. No uploads. Outputs a portable evaluation bundle + DSSE signing request for an identity‑anchored report.

- Deterministic dispositions: PASS / FAIL / HOLD with stable reason codes.
- Fail‑closed semantics: missing/unverifiable prerequisites block side effects.
- Portable evidence: receipts (JSONL) + summary report for internal procurement/security tickets.

Pilot outputs you can attach to a Jira ticket: Conformance Pack `.zip` + receipts `.jsonl` + DSSE signing request `.signing_request.json`.

Download Pilot‑in‑a‑Box Verify offline (/verify) Procurement kit

Public‑safe. Non‑binding. No SLA. No license grant.

### Design partner pilot (6–12 weeks)

Start with one gateway (egress or dispatch). Prove non‑bypassable control + receipts. Expand after.

Request NDA package via security@