Identity and secrets
Agents authenticate at the proxy. The full production design uses mTLS and keeps upstream credentials in a separate secret store until a call is authorized.
Evaluate the boundaries before you trust the control plane.
Clavenar is founder‑led and being built toward v1. This page documents the current security boundaries and limitations; the product is not presented as independently certified or suitable for every production workload today.
Current assurance status
| Area | What is available now | Important limit |
|---|---|---|
| Product maturity | Tagged open‑source releases, public specifications, a browser verifier, and a full‑stack pilot path. | The commercial control plane is pre‑v1 and requires direct founder involvement for any scoped evaluation. |
| Compliance | Evidence fields and starter policies can be mapped to common control frameworks. | Mappings are not certification, attestation, legal advice, or proof that a customer deployment complies. |
| Performance | The published mock‑mode run measured 2.20 ms p95 on a cache hit and 20.1 ms p95 on a cache miss. | The mock run excludes live provider latency. Models, policies, network, and storage can dominate the real result; review the setup and re‑measure it. |
| Cryptographic evidence | Canonical ledger rows commit to their predecessors with SHA‑256 and can be replayed by correlation ID. | A hash chain can reveal alteration after capture; it cannot prove that omitted or inaccurate input was true. |
The agent asks. The control plane decides.
The production design keeps the authorities needed to cause and approve side effects outside the agent process.
The agent does not receive
Real upstream credentials
Direct upstream socket
Policy mutation rights
Approval authority
Ledger rewrite path
Policy and approval
Rego policy, velocity state, and human approval resolve before the upstream side effect. Sensitive requests stay pending until an authorized decision or expiry.
Evidence and retention
A pilot defines which request, verdict, approval, and outcome fields are stored; who can replay them; where exports go; and how long each tier is retained.
Decisions to make before enforcement.
A production pilot should leave none of these implicit.
Available as control mappings, not attestations
- SOC 2 control mapping
- EU AI Act Art. 11/12 mapping
- NIST AI RMF mapping
- ISO/IEC 42001 mapping
Your security, legal, and compliance teams remain responsible for deciding which controls and obligations apply.
Implemented attestation, approver‑provenance, signing, retention, and deployment claims follow the versioned claim boundary. Technical evidence is not certification, not legal advice, and not a guarantee of admissibility or acceptance.
The compliance derivation boundary names the configured authorities and exact release, all bounded fail‑open paths and their signals, and the fail‑closed verification outcomes. Cold or stale JWKS rejects a presented delegation grant. satisfied is a mechanical predicate for one exact deployment and evidence window, not a conformity assessment; partial marks incomplete applicable evidence and no_data is not a pass.
The retention claim boundary records exact HIL deadlines, Ledger vacuum constraints, recovery‑point timing, and export destinations without turning them into a universal duration. Implemented technical bounds are not a universal retention promise. A fixed‑duration claim requires a separate approved lifecycle receipt covering the exact storage policy, deletion, legal hold, key retention, cost, restore evidence, counsel review, and public wording.
The public operational-information policy keeps sanitized product architecture, portable contracts, public interfaces, and release evidence available while deployment-specific operating procedures are maintained privately. Public entry points are interfaces, not a topology disclosure. No exception is approved for this release; a public exception requires a reviewed classification receipt bound to the exact source, surface, threat review, approvals, and expiry.
Report a security issue privately.
Send the affected component, impact, reproduction steps, and commit or release identifier. Please avoid accessing data that is not yours or disrupting shared services.