Deny-by-default. Human-rooted. Fail-closed.

posture

The threat model comes first

Agents read attacker-influenced content all day: web pages, documents, messages from other agents, tool output, retrieved memory. Any of it can carry instructions. Meanwhile the agents themselves hold delegated authority — tools, data access, budgets — which makes every agent a potential confused deputy and every self-improvement loop a potential privilege-escalation path. JEEZ's architecture is organized around exactly those two facts, and the threat model is treated as a living discipline — never a one-time exercise.

invariant 1

Data is never instructions

Every ingress — agent-to-agent messages, memory retrievals, tool outputs, free-text fields in configuration, even security telemetry — is typed as untrusted data. It is never concatenated into a privileged prompt as if it were a command. Externally-influenced content is untrusted by default and rendered as inert data all the way up to the operator's screen, so neither the model nor the human can be socially engineered by attacker text styled as system text.

invariant 2

A hard, human-rooted trust tier

The controls that define safety — policy, evaluation, signing keys, the Charter, and the kill-switch — sit in a strictly higher trust tier that is rooted in humans. Nothing agent-authored can ever reach across that boundary, and anything in the higher tier changes only through human-controlled review — never by an agent. An agent's identity cannot modify its own grants, its own budget, or the gate that judges it, and no agent ever approves its own change.

invariant 3

Fail-closed everything

Deny-by-default is the resting state of the platform: tool access, network egress, name resolution, and capability grants all start at zero and are opened by explicit, reviewed grants. A timeout, an error, or an ambiguous result means deny — never "proceed". Safety and compliance are disqualifying constraints that sit outside any optimized metric, because a competitive self-improvement loop will otherwise breed the best rule-bender. Spend is debited before every model and tool call; at zero the platform refuses — a runaway agent stops at the cap you signed, and an unsigned Charter will not run.

supply chain

Everything that loads is signed

Container images, agent skills, and model weights are cryptographically signed, and every signature is verified before anything loads — verification failure blocks the load, full stop. Marketplace skills pass a security review before publication, high-privilege skills additionally require human review, and a published version can never be silently swapped or impersonated. Revocation is honored: a revoked skill never loads again.

identity & isolation

Per-agent identity, no held secrets, sandboxed compute

Every agent workload gets its own cryptographic identity and least privilege for its role. Agents never hold long-lived secrets, and secrets are redacted by construction so they never appear in agent context, logs, traces, or eval transcripts. Workloads run in isolated sandboxes, and tenant memory is encrypted and isolated per corporation.

controls

Human control where it counts

The artifacts that define safety — policy, budget caps, signing keys, the kill-switch — change only through human-controlled review; agents cannot change them. Destructive actions require explicit, deliberate human confirmation. And the kill-switch is human-held: humans can stop a corporation at any time, and agents can neither trip it nor undo it.

evidence

Audit and observability you can verify

Every consequential event — tool call, grant decision, skill verification, kill, escalation — is appended to a hash-chained audit ledger: tamper-evident by construction, verifiable link by link. Traces follow every mission end to end, and security telemetry is monitored continuously — and per invariant 1, treated as untrusted data, because attackers write logs too.

straight talk

What we do not claim

• No compliance certifications are claimed today. When audits complete, we will say so plainly.
• No production customers or uptime figures are claimed. The platform is in active development.
• No "AI safety solved" claims. The invariants reduce blast radius and make violations disqualifying and visible; they do not make models infallible.

What you can verify instead: the posture described here is the posture the platform enforces, and every change to the platform is gated by security testing before it ships.