Every mechanism. And how to test it.
Autonomous AI now acts at machine speed in environments where an action carries legal and operational consequence — and cannot be undone. HexaBox makes that power usable there: every decision on a tamper-evident record, verifiable afterwards — proven before release, enforced at runtime, independently re-verifiable.
Don't take our word for it.
No single part here is new. Fail-closed and gate-before-call are published elsewhere, and we make no claim on them. What we claim is a property of the architecture, not a feature — and it is only visible when you look at the whole. So we tell you how to break it.
One declaration, three outputs.
The gate, the fleet governance and the evidence are generated from the same declared contract. There is no second place where a rule can be written differently.
The same declaration at every level.
Agent, fleet and federation are governed by one contract shape. Fleet Command and Federation Command run under the same declaration as the agents they govern.
Proof that does not require trusting us.
HexaRecord is a tamper-evident SHA-256 hash chain whose verification instructions are in the report. A third party verifies it offline, without HexaBox in the loop.
Built in, or placed around.
The contract is built into agents from the Factory and can be placed around agents built by anyone else. Placed around, it gives the gate, the proof and fleet governance; it does not give the Factory's control of what happens inside the agent. We say so plainly.
AI → proposed action → HexaBox → execute, hold, or deny.
The boundary checks the agent's identity, its mandate, the approval level, the evidence and the required approvals. Within mandate: execute and log. Human decision needed: hold. Outside mandate: deny — the action never runs.
Deterministic means the same input always gives the same authority verdict. It does not mean controlling what the AI thinks. HexaBox makes the authority to act machine-verifiable and provable.
Nothing consequential runs without its level.
CCAS — HexaBox's tiered authority gate — assigns every action a level when the agent is built. The organisation defines which actions belong in each level. It is a hard gate, not a promise.
| Level | Required authority | Security operations example |
|---|---|---|
| T1 Automatic | Executes and is logged | Only actions assigned automatic authority — look-ups, acknowledgements |
| T2 Single confirmation | One confirmation | Only after its required confirmation — a reversible step |
| T3 Human approval | A named, logged-in person approves | Blocking an external IP address; isolating a host; disabling an account |
| T4 Two independent approvers | Two approvals; never automatic | The most severe consequential actions — a fleet-wide mode change |
Six things a trustworthy agent must get right. A mechanism for each.
AIUC-1 — the AI-agent trustworthiness standard — describes six areas. HexaBox binds an enforced, gated mechanism to each, by construction, and ships the evidence for independent assessment.
k-anonymity cohort contracts (k ≥ 5) and a fixed-floor PII gate that blocks before anything leaves.
Port independence and zero-trust model calls — credential-resolved, prompt-injection spotlighted.
The CCAS tier ladder — privileged actions declared and gated; T3 and T4 escalate to human and dual approval.
Fail-closed execution and port contracts block actions that do not satisfy the required checks.
A tamper-evident hash-chained audit and an Ed25519-signed, root-chained agent identity.
A sovereignty guard — cohort and incident data leave only to stores the customer owns, fail-closed.
What each part actually does.
A tamper-evident SHA-256 hash chain: one chain per customer, with one chain per case inside it — every case links into its customer's chain. It covers every hand-off between agents, every gate decision, approvals, reclassifications and closure. Reports carry the chain hash and verification instructions; an auditor or regulator verifies independently, without trusting HexaBox. Reports are written only from recorded facts; unsupported sentences are dropped and the drop is counted. Report states: drafted, reviewed, approved, delivered, acknowledged.
Each agent carries an Ed25519-signed, root-chained identity. Its doctrine score, drift and lease are attested and re-verifiable on demand. CEVE — HexaBox's re-verification score for those checks — is a structural conformance check, not a certification. The signed identity anchors the agent's supply-chain evidence.
If a check cannot be completed, the action does not run. Fail-closed execution and port contracts block actions that do not satisfy the required checks. Port independence and zero-trust model calls are part of the security mechanisms.
The sovereignty guard allows data to leave only to stores the customer owns. Specialist models can run on the customer's own hardware. Multi-tenant isolation keeps every tenant separate within one fleet. Signals shared across customers are counts only, never names, with a k ≥ 5 cohort floor; personal data is checked before anything leaves.
Factory → Fleet Command / Federation Command → agents → Driver Seat → HexaRecord. Factory defines the agent's rulebook. Fleet Command governs a fleet; Federation Command extends that control across several fleets. Driver Seat is the approval desk. HexaRecord is the receipt. Agents built outside the Factory can be brought under the same declaration — the contract placed around them.
Eihwaz: one SOC hub, one Fleet Command, one Federation Command and seven specialists with detection-and-response competence. Specialists sign their assessments and propose actions; they never execute them. The advisory assistant is never in the decision path and cannot execute, block or propose actions.
Evidence for review, inside every artifact.
Two layers, kept honest. Governance mechanisms enforced and re-verifiable on every agent — and the domain standards each vertical considers, with evidence structured for independent review.
HexaBox architects for these standards and ships the audit-ready evidence — it does not claim to be “certified” or “compliant”. Certification is an accredited third-party audit; HexaBox provides the evidence, already inside the artifact and independently re-verifiable offline.
Bring your own tools.
Describe a job — we build the governed agent. Or bring an agent you already have and we place the contract around it. Then attack it and verify the record yourself.