Trust starts with clear boundaries.

§ 1 — CURRENT POSTURE

■ AVAILABLE / STAGING / ALIGNED — scope stated per item ■ DESIGNED TO MAP / AGAINST — engineered for it, not yet attested ■ ROADMAP — planned, stated as such ■ NOT CLAIMED — no certification or ATO held

AVAILABLE / STAGING EVIDENCE

The connected proxy issues signed HMAC receipts. The Mission Authorization Gateway's Ed25519, hash-chained edge receipts run on staging with a public verifier and published staging key. TLS 1.3, data minimization, and dependency scanning are in place.

ON THE ROADMAP

SOC 2 Type II and ISO 27001 audits. Encryption at rest with managed key rotation. FedRAMP and ATO pathways. On-premises and air-gapped deployment. Independent penetration testing.

WE DO NOT CLAIM

Any completed certification or authorization — SOC 2, ISO 27001, FedRAMP, ATO, CMMC, FIPS, NSA cross-domain. No independent audit report exists yet. Nothing on this page is held or authorized status.

§ 2 — PER-PRODUCT STATUS MATRIX · RECORD v1.3 · 2026-08-05

One versioned record per product: what it is, where it intercepts, what it covers, what it does not, and how its decisions are evidenced. Product pages sell the capability — this matrix is the canonical record behind them. Where the two differ, this page wins. Changes land in the change log below, dated.

Mission Authorization Gateway (MAG) FLAGSHIP

LIVE ON STAGING · MANAGED PILOT AVAILABLE

FORMERLY THE HIGH-ASSURANCE GATEWAY — RENAMED 2026-08-01 · ARCHITECTURE AND ASSURANCE STATUS UNCHANGED

BUILD Deterministic mission and external-effect authorization, high-assurance tier: protocol break (content re-originated, never forwarded), canonicalize-then-evaluate decision core, action authorization, and output conformance — a reference-monitor-inspired architecture for AI-driven actions and external effects. An AI model may supply a proposal or context; deterministic policy alone makes the enforcement decision. Policy is versioned; the same canonical action, policy version, and context produce the same ruling. Ambiguity resolves to DENY; fail-closed. INTERCEPTION POINT The mission boundary. AI-mediated flows crossing the edge — prompts, tool calls, commands, boundary-crossing requests — ruled on before they cross. SURFACES Edge action authorization and output conformance APIs; diode interface with simulated driver. OUT OF SCOPE TODAY Physical Owl data-diode driver (pending vendor SDK — interface and simulator are implemented). No production deployments; pre-ATO. DEPLOYMENT MODE Staging, with a public receipt verifier and published staging key. Air-gap-capable architecture designed for DDIL; egress-blocked runtime CI-proven (on-prem). Pilots are scoped at a briefing and deployed with our engineers. RECEIPT SCHEME Ed25519-signed, hash-chained edge receipts — verify a Gateway staging sample in your browser. NON-BYPASSABLE / MEDIATION SCOPE MAG is non-bypassable by architecture: it sits in the action path, re-originates content rather than forwarding it, and fails closed — there is no route around the decision core for the traffic it governs. How much of an environment that covers is set at deployment, and engineered with our engineers: protected interfaces reject unmediated actions, direct agent routes are removed or separately governed, and credentials and egress are brokered or constrained. Routes a deployment deliberately leaves direct — HTTP, shell, filesystem, database, actuator, or network — are outside the mediated set, and this record scopes its claims to the paths MAG governs. GRADED SEAM / UNGRADED SEAMS Published conformance work grades the edge action-authorization seam. The Gateway also exposes an on-premises tool-authorization seam and a governance-sidecar gate; neither is separately graded, and we make no conformance claim for them. Grading them may raise the picture rather than lower it, but until it is done we do not claim it. One exception is listed rather than left unlisted: the sidecar carries a detect-only mode and a gating timeout that can pass traffic when enforcement does not complete. Defaults are the safe ones, and this is stated because an unlisted exception is the one that survives review. FRONTIER AGENT CONTROL Core primitives available in the MAG architecture: action authorization; target, tool, and parameter constraints; provenance and anti-replay; command-rate policy; classification-spillage controls; indirect-prompt-injection and adversarial-Unicode screening; output conformance; signed decision evidence. Destination/egress brokerage, credential brokerage, delegated-authority ceilings, trajectory-state policy, emergency revocation, and complete-mediation evidence are deployment-specific integration or extension scope unless separately marked implemented. Solution page: Frontier Agent Control. EXPLICITLY OUT OF SCOPE

Kernel, hypervisor, container-runtime, or package-proxy hardening.
Model alignment, interpretability, or anti-scheming training.
Weight security and autonomous-replication prevention.
Direct paths that do not pass through a configured MAG enforcement point.
A guarantee that every unintended model behavior will be detected or understood.

Agent Governance

AVAILABLE · CONNECTED TIER

BUILD LLM-boundary proxy (no code changes) plus an SDK that guards tool dispatch. Deterministic policy—not an LLM judging an LLM—makes the enforcement decision before execution. INTERCEPTION POINT Before execution — between the agent's proposed action (LLM call, tool call, mediated dispatch) and the side effect. A denied action never touches the tool, the API, or the database. SURFACES Proxy covers LLM traffic to OpenAI, Anthropic, Bedrock, and Azure OpenAI; the SDK wraps the tools your agents call. OUT OF SCOPE TODAY Direct HTTP from agent code, filesystem, shell, and raw database access — flagged as gaps in our AARM attestation. No silent coverage claims. DEPLOYMENT MODE Connected tier: cloud-hosted proxy; SDK runs in your agent runtime. RECEIPT SCHEME Signed HMAC decision receipts from the connected proxy record the request, policy version, and outcome. HMAC integrity is verified inside the deployment; policy re-evaluation is a separate operation requiring the exact recorded input, context, and policy bundle.

AI Chat Firewall

AVAILABLE · FREE WORKSPACE + MANAGED PILOT

BUILD Managed browser extension. The full prompt is evaluated over TLS and is not stored by the policy check. INTERCEPTION POINT Submission time, in the browser — the check runs before the prompt reaches the AI provider. SURFACES ChatGPT, Claude, Gemini, Copilot, and Grok. OUT OF SCOPE TODAY Web-AI surfaces beyond the five supported. Non-browser paths — native desktop apps, and API or agent traffic, which is Agent Governance's boundary. DEPLOYMENT MODE Managed extension; fail-closed by default, with any explicit per-domain fail-open choice audited. Free workspace up to 15 users with prebuilt guardrails; managed pilots scoped now. RECEIPT SCHEME Every ruling writes an audit-ready, tamper-evident receipt; 30-day audit history on the free workspace.

"Formal verification underway" — what that means

IN PROGRESS · NO COMPLETED PROOFS CLAIMED

When a product page says the Mission Authorization Gateway's formal verification is underway, this row is the substantiation. Targets and tooling below are drawn from the Gateway's engineering test plan (§4.6.1, Formal Verification Targets).

TARGET PROPERTIES Parser termination (any bounded input terminates) · canonicalization uniqueness (equivalent inputs produce the same canonical form, and only equivalent inputs do) · policy totality (every valid input produces a decision — no undefined states) · audit completeness (every decision produces an audit record — no silent drops). TOOLING Model checking of the selected components with TLA+ / Kani (Rust model checker), alongside continuous fuzzing and a determinism regression corpus. MILESTONE Gateway Phase 5 — High-Assurance V&V. Exit gate: formal proofs complete. ARTIFACT WHEN COMPLETE Proof certificates, published to this record. Until they are published here, no proof is complete — parsing-path verification is in progress, and that is the whole claim.

CHANGE LOG — THIS RECORD

DATECHANGEARTIFACT

2026-08-05 v1.3 — reconciled against the Gateway engineering repository rather than waiting for the next quarterly review. Three disclosures added, no claim widened: the AARM alignment is scoped to the connected-tier proxy and its v1.0 basis is stated explicitly, with CSA’s CS-1 First Edition position and our self-logged witness class named; the Gateway’s ungraded tool-authorization and sidecar seams are declared as unclaimed; and the sidecar’s detect-only/timeout exception is listed. Architecture unchanged; this update only narrows what we assert. AARM row · Gateway matrix row · this change log

2026-08-04 v1.2 — complete-mediation note restated. Non-bypassability is stated as an architectural property of the Gateway; the deployment prerequisites are restated as the scope of the mediated set rather than as a qualification of the term. The prerequisites themselves are unchanged, and routes a deployment leaves direct remain explicitly outside the mediated set. Architecture and assurance status unchanged. Gateway matrix row · this change log

2026-08-01 v1.1 — Mission Authorization Gateway (formerly the High-Assurance Gateway) rename annotated on the Gateway row; build description restated as deterministic mission and external-effect authorization; complete-mediation (system property / deployment-specific), Frontier Agent Control scope, and explicit out-of-scope notes added. Architecture and assurance status unchanged. Gateway matrix row · this change log

2026-07-12 v1.0 — per-product status matrix and formal-verification substantiation published; record versioned. Per-product matrix · formal-verification note

2026-07-09 Quarterly review of the canonical record. This page

2026-07-02 Three Trust-page claims corrected after a Gateway deep-dive verification pass. Site change record #355

2026-07-01 Trust page rewritten around current state, roadmap, and non-claims. Site change record #349

Site change records and the Gateway engineering test plan live in private repositories — diffs and documents are available in vendor diligence via compliance@containment.ai.

§ 3 — DATA HANDLING · MINIMAL BY DESIGN

COMMITMENTWHAT IT MEANSSTATUS

No training on customer data Customer prompts, responses, and policies are never used to train AI models — ours or anyone else's. AVAILABLE TODAY

Data minimization We store only what is needed to evaluate policy and produce audit evidence. AVAILABLE TODAY

Configurable retention & deletion Set retention windows, export decision logs, and delete data on request. AVAILABLE TODAY

GDPR / CCPA mapping Enforcement, audit trails, and retention controls are designed to map to these regimes; DPAs and DSARs supported. DESIGNED TO MAP

Data residency options Region-scoped storage (e.g. EU) for customers with residency requirements. ROADMAP

On-prem & air-gapped deployment Complete data sovereignty with offline policy enforcement for high-assurance environments. ROADMAP

§ 4 — ENFORCEMENT & AUDIT EVIDENCE · PRODUCT-SPECIFIC DECISION RECORDS

Decision records, by product

Each governed outcome produces a decision record. Signature, chaining, retention, and verification differ by product and are stated in the matrix above.

Policy re-evaluation

A deterministic ruling can be re-evaluated only when the exact recorded input, context, and policy bundle are available. The public Gateway verifier checks receipt integrity, signer key, and supplied chain-segment continuity; it does not re-run policy.

Exportable audit trail

Decision records export for your own review, retention, and downstream compliance workflows.

Scope note: this is the platform’s own enforcement evidence — distinct from a third-party assurance report, which does not yet exist.

§ 5 — CANONICAL ASSURANCE STATUS · NONE HELD OR AUTHORIZED TODAY

STANDARD / FRAMEWORKSTATUSNOTES

SOC 2 Type IIROADMAPPlanned — audit not yet started; not certified.

ISO 27001ROADMAPPlanned — not yet started; not certified.

FedRAMPROADMAPNot authorized; not on the FedRAMP Marketplace.

CMMC / NIST SP 800-171DESIGNED TO MAPNot certified or assessed.

FIPS 140-3ROADMAPNot validated.

ATOROADMAPPre-ATO; no production deployments yet.

NSA cross-domain (NCDSMO)DESIGNED AGAINSTDesigned against NSA cross-domain standards; not NSA-certified, not on a baseline.

HIPAADESIGNED TO MAPNot independently attested; BAAs expected for Enterprise.

GDPR / CCPA · FINRA · PCI DSSDESIGNED TO MAPNo formal attestations; DPAs / DSARs supported.

AARM v1.0 (CSA)ALIGNEDPublic self-attestation covering the connected-tier proxy: R1–R6 satisfied at Core, R8 satisfied, R7 a gap, R9 out of scope. No third-party certification. Stated against v1.0. CSA’s CS-1 First Edition (“v3”) promotes R10 (action risk classification) and R11 (source provenance) from SHOULD to Core MUST and adds an Edge & Lifecycle profile (R12–R15); our position has not yet been restated against it, and under v3 several requirements we record as satisfied would read as partial. v3 also re-frames “attested” as three witness classes — self-logged, assessor-engaged, independently-verified — and ours is self-logged, the weakest of the three.

Full framework mapping on the Compliance page.

RUNNING VENDOR DILIGENCE?

We answer security questionnaires with this page as the source of truth — and we'll say "not yet" where the answer is not yet. Ask for the current status letter.

REQUEST STATUS LETTER

§ 6 — DILIGENCE CONTACTS

SECURITY

security@containment.ai

Controls, vulnerability disclosure, security docs

COMPLIANCE

compliance@containment.ai

Certification status, framework mapping, roadmap

PRIVACY

privacy@containment.ai

Data handling, retention, DPAs, DSARs

THE REST OF THE RECORD — HOW WE RUN ON IT → POSTMORTEMS → WHITEPAPER → COMPLIANCE →