Security by construction.
Written for the CISO and the architect: what the control plane protects, what protects the control plane, what it trusts and what it never does. Concrete capabilities only — no claims we cannot demonstrate.
SECURITY BUILT FOR AUTONOMOUS IDENTITIES
The controls below are the detail. This is the shape of the problem: most security models assume a human at the keyboard, and an agent is not that.
THREAT MODEL
- Data leaving the organisation through a model, an agent or a sink — mitigated by classification, destination recording and sink policy.
- Untrusted content steering an agent (prompt injection via web results, documents, tool output) — mitigated by trust propagation: untrusted input lowers the trust of everything derived from it, and policy acts on that trust at the moment of action.
- An agent exceeding its mandate — mitigated by operating envelopes (models, tools, environments, classification ceiling, hours), unknown-agent denial and the response ladder.
- Credential exposure — mitigated by brokering: provider keys are held by the appliance and never reach a client or a prompt.
- Compromise of the control plane itself — mitigated by Imperium Sentinel, an independent deterministic security plane.
WHAT TRACSTON TRUSTS — AND WHAT IT DOES NOT
| SOURCE | TRUST | WHAT FOLLOWS |
|---|---|---|
| User input | UNTRUSTED | classified and policy-checked before any model sees it; never a credential, never an instruction to the control plane |
| External web content | UNTRUSTED | lowers the trust of the context it enters; derived output cannot reach an external sink above its trust |
| External MCP server / tool output | UNTRUSTED · POLICY CONTROLLED | allowed per agent allowlist; tool contracts are checked for drift; output is treated as untrusted content |
| Model output | POLICY CONTROLLED | inherits the lowest trust of its inputs; inspected before the sink |
| Internal signed service | TRUSTED | identity pinned (mTLS, node identity); policy bundles verified by content hash |
| Verified identity | TRUSTED IDENTITY | resolved at the edge from a session or an enrolled token; carried on every hop; never taken from a client header |
Propagation: trust is a property of data, not of a request. It flows with the data through context, model and tools, always downward, and the sink decision uses the trust the output actually has.
SENTINEL IS AN INDEPENDENT SECURITY PLANE
Imperium does not protect Sentinel; Sentinel independently observes Imperium. It verifies binaries, policy bundles and configuration against its own baseline, watches admin sessions, certificates and unexpected listeners, and on drift it freezes the admin session, seals evidence, enters safe enforcement (the last verified policy stays in force; anything requiring a fresh admin decision is denied) and notifies security out of band. Its core enforcement is deterministic — no model is consulted to decide whether the control plane is intact.
Know what left the organisation.
Every execution carries its destination — in-house, private or external — recorded by the appliance, never guessed from a URL.
EMPLOYEE TRANSPARENCY — NOT SURVEILLANCE
Imperium is deployed to govern AI, not to profile employees. It does not imply — and does not default to — screen recording, keystroke monitoring or secret employee profiling. Employees can see what is inspected, what is retained, which policy applies, why something was blocked, what their own AI activity costs and which data classification applies.
AI traffic inspection and conversation retention are separate controls. Inspection is what the gateway evaluates in order to reach a decision; retention is what is kept afterwards — configurable by application, department, classification, purpose and policy, from metadata-only to full text. Regulated organisations can retain more without the platform behaving like spyware everywhere else.