Saphan

What is in place — control by control.

Not a feature list. The floor an enterprise gets today: one row per control — what it does, what it refuses, and what it leaves in the record for the person who was not there.

The floor, as it ships today

Control	What is in place	What the record holds
Signed governance record	Actors, delegations, machines, seats and capabilities in one Ed25519-signed, append-only log. Every human-readable registry is a projection of it — regenerable, never a source.	The whole governance history, verifiable by a third party holding only the root public key — without trusting the machine that produced it.
No implicit approval	No timeout-as-consent and no ambient auto-accept. A gate requires a human decision or an explicit, bounded delegation from a human-signed policy; it has no default value and is refused out of order. The engine never grants itself authority and never performs the merge.	One gate row per decision: actor, closed-vocabulary decision, time, and the authority chain. “Merged” is never declared — only observed from a real merge commit.
Tamper-evident decisions	Each acceptance is a keyed, verified tuple, re-checked at merge. Edit any field afterwards and the verification breaks.	The tuple and the result of its check at merge.
Suggestion ≠ decision	A consultation — AI or human — is recorded as judgment; the decision is a separate act by an authorized actor. Automated authority must trace to a bounded, human-signed delegation; an override is itself recorded.	Distinct recommendation and decision rows per gate — not only what was decided, but what was recommended and by whom.
Machine identity by certificate	No registration endpoint, no join token. A machine is admitted by an explicit owner act with certificate binding; the control plane connects outward only, and runners hold no credential to it.	The admission act in the signed log; the certificate chain.
Delegated, bounded authority	Root-signed delegations with scope, work streams and a validity window. Expiry is a ceiling, never a trigger; retiring an actor takes effect immediately, regardless of any unexpired grant.	The delegation, signature over every field — who granted what to whom, until when.
Ratified standing law	The documents that govern how work is done are root-signed into a serial-numbered manifest. Any document verifies back to the root; an agent works under law it can be shown to have received.	The manifest, and each run’s record of which law was injected — with its hash.
OS-level run confinement, local	Deny-by-default write policy from the operating system’s own sandbox — Seatbelt on macOS, Bubblewrap on Linux — composed for each run before the agent starts. A missing sandbox facility refuses the run instead of degrading it.	The run record names the tool that confined it and the directories that stayed writable — a claim your team can reproduce.
OS-level run confinement, remote	Kernel-enforced (Landlock) confinement for SSH-dispatched runs. A machine’s confinement capability is measured before work is routed there; a machine not measured, or measured incapable, refuses the run.	The measured capability on the machine’s signed row; the run record naming what enforced.
Outbound access is a list opt-in per run	A run that declares an egress policy reaches the network only through a door that policy governs: a destination is admitted only if the policy admits both host and port, and the default admits nothing. A host that cannot enforce the network cut refuses the run rather than starting it open. The door terminates no TLS and parses no HTTP. Opt-in per run in this release — there is no fleet-wide default yet, and a run that declares none is outside this control.	The compiled policy’s digest on the run’s row — which list governed this run. For runs on the control plane’s own machine, one row per connection judgement: host, port, verdict, reason class, time, policy. For SSH-dispatched runs the per-connection rows do not yet travel home.
No lateral agent channels	Agents coordinate only through recorded surfaces — orders, channel files in the stream’s own worktree ingested into the record, gates, an insert-only mailbox for the owner’s directives. No agent-to-agent messaging exists in the product.	“Who told whom what, when” is a query, not an interview — the coordination history of a stream, replayable from the record.
Refusals as data	Every refusal — engine, authorization, schema, policy — is a recorded, zero-cost row with a named class. Denial causes are logged, never returned over the wire.	The refusal ledger: the controls firing, not merely existing.
Monitoring — a Prometheus target	The serving daemon exposes `GET /metrics` in the standard Prometheus text format: runs by status and backend, refusals by class, gate decisions by gate and decision, store schema version. Label values are class names only — never stream names, paths or actor names.	Refusals as a first-class metric — on this architecture a refusal is a security signal, not noise. Scraped by the Prometheus you already run; nothing to install.
Secret values stay out of records	Configuration and dispatch types carry names and references, not secret values. Key files are custody-checked before use; remote execution disables environment forwarding. Credential-owning processes may use values for authentication without copying them into the work record.	Configuration by name. No secret value in any operational record, evidence bundle, log, cost row or export.
OAuth 2.1 on the management surface	Bearer-gated. Team authenticates through the Saphan-operated `saphan-oauth` SaaS. Enterprise runs `saphan-oauth` locally or admits any customer IdP through a human-gated issuer trust list. Scope classes, tenant row-level slices, fail-closed by default.	An audit-grade access log on every transport — honest status codes for wrapped refusals, no values or query strings ever logged.
Cost governance	Per-run quote and hard cap set before dispatch; capacity checked before the run starts; billing classes on seats. Actuals and drift land next to the evidence, not on a separate invoice.	The cost ledger, per stream and per gate — “what did this change cost” gets the same one-line answer as “who approved it”.
Supply-chain pinning	Agent binaries are delivered with a digest computed on the receiving machine, and identity is re-resolved where they execute.	Per run: binary digest, version, configuration hash, the standing law injected and its hash.
Your record store	A PostgreSQL record store on infrastructure you control, configured by name, credentials by variable name only. Code, run evidence and the operational record do not transit Saphan infrastructure. Team sends identity to Saphan-operated OAuth; Enterprise keeps identity local. Both can use mobile notification signalling carrying only an opaque gate id and badge count.	Your database, plus plain files in your git. Readable without our tooling.
Conformance, not assertion	End-to-end scenarios run against the real binary: gate discipline, dispatch locking, injection resistance, misrouted instructions, the OAuth flow, bearer gating, projection parity.	The conformance results, reproducible on your deployment.

shipped in the enterprise build in implementation built in part, not yet a delivered path planned on the roadmap, no code presented — rows without a tag are shipped.

Fail-closed is the house style: an unrecognized configuration value, a missing sandbox, an ambiguous bind address — each refuses with a named class rather than falling back to a weaker posture. Where a control does not yet enforce, the documentation says so in as many words, and the roadmap names it.

How these rows map onto ISO 27001, ISO/IEC 42001, SOC 2, NIST AI RMF and the EU AI Act →

More of Saphan Studio

Compliance — where these rows map →Enterprise — your machines, your record →Governance — decisions on the record →Security — untrusted agents, provable runs →

Design partner inquiries