This preview is password protected.
45 capabilities built and running · 3 delivered as services · 4 designed and scheduled · 1 named gap. This index is generated from the same layer map the engineering team works from.
Find: identity layer and agent discovery
Scans agent configs, scores each with the agentlint engine.
Fingerprints agents actually running; flags undeclared instances.
Names NEW, CHANGED, and MISSING agents against the registry.
Counts tool servers from config; flags undeclared servers.
Dataset inventory with owner and rights flags.
Tracker integrity report and per agent cost view.
Parsers for SSO sign in logs, OAuth grant exports, and SaaS admin exports. Flags undeclared AI apps, broad OAuth scopes, and risky admin grants. Built in Step 3.
Deck slide 13: undeclared keys on sight, consent phishing grants, rogue MCP risk reads, and new activity hour findings the platform drift module does not compute.
Built October 18, 2026 on Greg's world class directive. Fuses all seven Find planes (registry, runtime logs, identity, MCP inventory, endpoint artifacts, DNS and proxy metadata, cloud audit logs) into entities with corroboration weighted confidence, severity, MITRE tags, a recommended action per verdict, and named blind spots (browser session telemetry remains named blind, not hidden). Demo estate: 27 entities, 16 undeclared, 9 declared, 2 candidates, 5 MITRE techniques, 7 of 8 planes instrumented.
Built October 18, 2026, closing the named DNS blind spot. Provider lookups and proxy connections per client, heartbeat cadence measured on lookups (near duplicate DNS plus proxy stamps collapsed), undeclared provider access findings. Demo: the employee bot's 30 minute rhythm is visible in network metadata alone, and an unknown workstation reaching xAI is flagged.
Built October 18, 2026, closing the named cloud blind spot. Normalizes CloudTrail, Azure activity, and GCP audit shapes; reads model invocations (Bedrock, Azure OpenAI, Vertex), credential creation, and secret access per actor against declared actors. Demo: a rogue AWS key's full lifecycle (invoke, mint a key, read secrets) plus an undeclared Azure deployment and a rogue GCP service account key.
Built October 18, 2026: the EDR and MDM pattern as a reference service. Endpoint enrollment, bundle intake with SHA-256 hash and per endpoint sequence accounting (changed versus unchanged), staleness flags for silent sensors, and one fleet wide artifact census over the latest bundle per endpoint.
Planted ground truth scorecard (demo-benchmark/ground-truth.json): 11 planted entities including a dormant artifact that must stay a candidate and a custom bot with no artifacts. Recall on the planted set 1.000; detections outside the planted set are listed as unscored, never hidden.
Produces artifact census bundles on a real machine with user level commands only: workspace artifacts, process snapshot, user crontab, established connection snapshot. Reference implementation of the bundle format; a fleet version rides an EDR or MDM.
Built October 18, 2026 from the HEARTBEAT.md lesson, with Jensen Huang and Sam Altman persona seats advising the detection design. Endpoint evidence side of Find: agent workspace artifact families (HEARTBEAT.md, SOUL.md, IDENTITY.md, AGENTS.md, MEMORY.md), scheduler wakeups, agent processes, and periodic provider cadence (the 30 minute heartbeat rhythm) are scored together and matched against the registry. Calibrated: a lone artifact is a low confidence candidate, never a verdict; absence of artifacts clears nothing, since process and cadence evidence can raise a candidate on their own.
Govern: documents, attestation, four layer kill switch
Built October 18, 2026 from the team review: one fixed deliverable per workflow before build sprints are sold. Blueprint (steps, human checkpoints, tools, data scope, telemetry, evaluation plan with baseline), a pre-build red team pass, and a governance review gate (named owner, destructive tools approval gated, data scope READY or REMEDIATE, kill switch mapped, telemetry and metrics named). Passing emits the governed starter config. Demo: invoice workflow READY FOR BUILD, inbox autopilot BLOCKED on eight counts.
Named owner, purpose, and access level per agent.
Hash chained, tamper evident. Attestations expire after 90 days.
One document per agent: identity, score, attestation, with verify mode.
Records mapped to the NIST AI Risk Management Framework.
Know Your Agent v0 coded in Step 5: HMAC signed claim, 30 day runtime expiry, verify checks signature, expiry, and tool scope hash against the live config. Demo key only; production key management is a deployment decision.
Built October 18, 2026, answering Greg's blocking question directly. A company policy (plain JSON) decides BLOCK, MONITOR, or ALLOW for every detected entity, in three postures: attested_only blocks every undeclared agent (demo: 16 blocked, 2 candidates monitored, 9 declared allowed); selective blocks named agents, keys, apps, endpoints, cloud actors, or providers (demo: exactly the 4 named entities blocked, named exception allowed); monitor_only watches everything for a discovery period. Block decisions carry the concrete actions per kind (edge denial, provider key revocation, IdP grant revocation, MCP allowlist removal, endpoint process stop, cloud credential deactivation, the kill switch layers). enforce.py applies decisions to a simulated enforcement state in the demo estate only; production execution rides the client connectors at each control point. Unblocking a revoked credential honestly requires re-issue under attestation.
Built October 18, 2026, closing the named gap. Full signing key lifecycle: generate (0600 material file, fingerprint only in reports), rotate (old key verify-only with a 30 day grace window), revoke (verification fails immediately), and verify against every live key through the real kya.py verifier via GSIS_KYA_KEY_FILE. In client deployments the material lives in the client's KMS or HSM and this lifecycle drives the same states.
Built October 18, 2026 from Sam Altman's seat question: an agent interacting with the platform must present a KYA attestation that verifies against its running config at interaction time. Fails closed with a stated reason; decisions can be logged as evidence. Demo: valid attestation ALLOW, drifted config DENY, no attestation DENY.
Session termination, permission revocation, rollback, full deactivation. Implemented and drilled in the isolated demo runtime only (Step 6). Never run against a real system.
Charter, Policy and Rules, Processes, Foundation, Starter. Services; the generator is built and produces each document from a client registry with real agents and owners, the framework mapping, and the not legal advice notice.
Built October 18, 2026 from the team review: vendor agent intake (KYA by declaration: CONDITIONAL in the demo on exit terms and security attestation, REJECTED outright if the vendor trains on client data), incident response plans (containment by kill switch layer, evidence pointers, timeline, post-incident review), and decommissioning certificates with a SHA-256 hash closing the attestation. Birth to death, nothing unaccounted.
Built October 18, 2026 after Greg flagged GSIS's government book: the platform's evidence in the buyer's formats. NIST 800-53 crosswalk (12 capabilities, 25 controls, 9 families: census to CM-8, zones to AC-3 and AC-4, ledger to AU-9), findings converted to POA&M rows with FedRAMP cadence due dates (critical 30 days, high 90, moderate 180), the AI use case inventory export agencies must maintain under the OMB AI memos (one row per registered agent, agency fields marked for completion, never invented), and AI impact assessment drafts generated from Design Sprint blueprints. Framework overlays (StateRAMP, TX-RAMP, CJIS) are included as data with Greg's October 18 decision recorded: they are a services motion per pursuit, not separate products. Named as still open, in this same map: FIPS validated cryptography (spec), the enclave deployment pack (spec), and a Section 508 console audit (offer).
Production government requirement, stated honestly: the demo KYA signing is HMAC-SHA256 in ordinary Python crypto, not a FIPS validated module. The keys.py lifecycle (generate, rotate, revoke) is built; swapping the signing backend to a validated module is the spec item.
Government estates often cannot phone home. The pattern exists in the build (collectors and the fleet intake run inside the client boundary and ship bundles; the platform reads log metadata, not the lake), but a packaged disconnected deployment with its own update path is spec, Phase 2 alongside hosted monitoring.
Built October 18, 2026 (board gap 2: our own vendor posture). SOC 2 readiness crosswalk with honest statuses (5 in place, 4 partial, 1 planned of 10 criteria), the platform's OWN POA&M in the same format we hand clients (FIPS, no independent pen test yet, borrowed key limit, blind spot, SOC 2 window not started, all with due dates), and a vendor fact sheet with four explicit not-claimed items. An independent pen test and a SOC 2 audit are third party engagements, recorded below as offer and spec, never claimed.
Third party engagement against the hosted build at Phase 2. Internal red team results are published in the meantime; a pen test is something GSIS's world understands must be independent to count.
Requires the hosted build plus an observation window. The posture pack is the readiness baseline; a Type I review can be scheduled once the hosted build exists.
Built October 18, 2026 on Greg's question: 'no agents allowed to interact with this data' as a first class control. A data owner declares a dataset NO AGENTS (overrides every agent, scope, and attestation) or ATTESTED ONLY (named, attested agents only). Enforced at design (a blueprint naming a NO AGENTS dataset is BLOCKED), at attestation (a declared scope including one is a ZONE_DECLARED_BREACH), and at detection (any estate touching one fires a critical OFF_LIMITS_ACCESS with a scoped revocation action). Demo: the PII customer export lake is NO AGENTS and the estate touching it fires critical; the governed agent's ATTESTED ONLY zones stay clean.
Deck slide 17: compares declared data scope against the data census and flags out of scope and BLOCKED datasets.
Build: governed agent construction
Built October 18, 2026 from the team review: the Census Sprint's second half. Candidate workflows scored on value, feasibility, and risk with a repeatable rubric mapped to NIST AI RMF, and no candidate ranks without a documented misuse case (Joyce's rule, test enforced). Demo portfolio: 5 ranked (2 BUILD NOW, the autonomous payments agent sent to GOVERN FIRST on risk), 1 incomplete for a missing misuse case.
Built October 18, 2026 from the team review: the platform data census packaged as the gate on Design. Per dataset READY, REMEDIATE, or NOT READY verdicts with named fixes; design does not start on NOT READY data. Demo: invoices READY, the PII customer export with an external vendor NOT READY, two REMEDIATE.
Agent Governance Score 0 to 100; GitHub Action included; live on GitHub.
Governed, mid, reckless, and scout configs proving the scoring ladder.
Generates a starter agent config that scores 100/100 under agentlint. Built in Step 4.
Built October 18, 2026, closing the named gap. Five scenarios run against the real detection modules: the quiet custom bot (caught by the DNS plane), the forged attestation (caught at the edge), the silent sensor (caught by fleet staleness), the drifted agent (caught at the edge), and the borrowed key, which is a designed MISS: attribution trusts shared keys, the residual risk is published with its mitigation (one key per agent, attestation bound to one config hash, verified at the edge). Scorecard: 4 caught, 1 missed, 0 hidden.
Oversee: dashboard, drift alerts, monitoring
Built October 18, 2026 (board gap 4). The managed service's contract terms as data, rendered to the client document so contract and code cannot drift: 24/7 automated detection, Managed duty desk 07:00 to 19:00 Phoenix Monday to Saturday with 24/7 S1 paging, four severities with examples from real finding types (S1: RED zone breach, rogue cloud key) and response clocks per model, three level escalation ending at the client's own owner, 5 percent fee credits for missed S1 responses capped at 25 percent, client responsibilities, and honest limits (no detection guarantee outside instrumented planes; no standing write access to client production).
Built October 18, 2026 from the team review: the day 90 proof inside Oversee. Baseline metrics from the Design Sprint compared against measured current metrics per workflow, with DELIVERING, MIXED, or NOT DELIVERING verdicts and honesty labels on the evidence. Demo: invoice workflow DELIVERING, cycle time down 73%, cost per case down 50%, errors down 56%.
Self contained HTML verdict: counted, attested, unaccounted, average score.
Estate snapshots, drift findings, repeated watch passes, JSONL alerts with webhook support.
Per client state separation. This project runs in workspace gsis-demo.
Deck slide 10: the six stage workflow with gate checks run against the real registry (nothing attested unregistered, nothing attested without a named owner).
Deck fees as data, the slide 9 base case computed and test asserted at $850,000, debrief, snapshot, sweep, and quarterly review generators, plan 90 and training artifacts, and the sourced ROI, cost, and regulatory clock brief.
Pattern borrowed from the ARIA Overwatch comparison, October 2026: every threat finding carries a technique id and the report counts technique coverage.
Pattern borrowed from the ARIA Overwatch comparison: each census carries a monotonic sequence and heartbeat so a consumer can tell a live sensor from a stale one.
Pattern borrowed from the ARIA Overwatch comparison: the hosted dashboard is a generated snapshot today; a console that refreshes on a cadence belongs to the Phase 2 hosted monitoring work.
Government consoles must be Section 508 conformant. The Oversee console is generated HTML (a good starting point), but conformance is an audit and remediation engagement, offered as a service item, never claimed from the build.
Oversee today is a scheduled toolkit run, not a hosted product. Hosting is gated on Greg.