Security review
This route is for reviewers evaluating the mechanism rather than buyers evaluating a purchase. It goes to the engineering group that owns the decision engine, and it is not a sales conversation.
What a review can verify
Each of these is a property of the implementation rather than a policy statement, and each one is checkable from a decision record or the engine itself.
The decision is a deterministic function
The engine has zero runtime dependencies on the network, a database, or any model SDK. The same evidence and the same pinned policy version produce the same decision, which is what makes a decision reproducible in a review.
No AI makes or modifies a decision
AI may propose typed assertions that become evidence. It cannot create, amend, or overrule an authorization decision, and the engine has no path by which it could.
Every decision is signed and retained unaltered
Decision records are KMS-signed and stored with WORM protection. A record can be verified offline, without calling the TrustRelay API, against the key your organisation supplied.
Tenant isolation is enforced below the application
Every tenant-owned row carries a tenant identifier and is protected by PostgreSQL row-level security. The application role has no BYPASSRLS, so a query that forgot its filter cannot cross a tenant boundary.
Review questions
Yes. The signature is over the record contents and is checked with the key your organisation supplied, so verification does not require a call to us and does not depend on our availability.
Every decision, override, and outcome is retained in an append-only ledger. History is never rewritten; a later override is recorded as a new entry that references the original.
Attribution is established from agent and repository signals. Where it cannot be resolved, the engine escalates to human review rather than approving on a guess, and that escalation is itself part of the record.
The evidence snapshot for the change: repository configuration, agent session and provenance signals, work-item context, and check results. Each item is recorded with the decision so a reviewer sees what was considered, not only what was concluded.
Numbers you can check
No pilot has run yet, so there are no customer metrics to report and we will not invent any. Each figure below was counted from the codebase, and the file that establishes it is named with the number.
- rules evaluated for every change
- 5Decision engine source — decision-engine/src/engine/decision-engine.ts
- stable reason codes a decision can report
- 16Reason-code registry — decision-engine/src/engine/reason-codes.ts
- byte-identical replays asserted in the determinism test
- 1,000Replay suite — decision-engine/tests/e2e/replay.test.ts
Want a demonstration instead?
The security route is for reviewing the mechanism. If you want to see it work against your own policy, use the enquiry form.