An AI you can let off the leash — because it's on rails.

A global kill-switch freezes every autonomous action for your whole org instantly. It fails closed — the switch beats any pending approval; queued actions wait until a human disengages it.

Self-host on your own cloud (AWS/Supabase in your account) so data never leaves your boundary. World-state intel is shared and global; your findings, exposure, and incidents stay strictly tenant-isolated.

Consequential changes pause at a human-gated desk before anything is applied — tier-gated, with irreversible/legal actions requiring a named human's signature that can never be auto-approved.

Every decision — automated or human — is recorded into a signed, replayable ledger (ed25519 over canonical contents). The same scheme covers your compliance evidence, so one verifier checks both.

The model only ever proposes; a deterministic predicate disposes. A prompt-injected agent literally cannot record a finding or take an action a tool didn't prove — so injection widens nothing it shouldn't.

A rules-of-engagement guard gates every agent action against the engagement's scope and budget, with an absolute destructive-action ban and explicit-consent gating for active exploitation.

The orchestrating agent never holds the tools or the host. Scanners run in per-scan sandbox containers on an isolated network, reached through a de-privileged Docker proxy — not a raw socket.

Connected systems prove ownership through their own OAuth consent. For a standalone target you type, you prove control by publishing a per-asset token via a DNS TXT record or a well-known file — verified against the live target before it's trusted.