Autonomy
you can audit.
The point of AI remediation is trusting it at 3AM. That trust isn’t a promise — it’s enforced, layer by layer, between any actor and your clients’ endpoints.
Defense in depth, not defense in marketing.
Each layer holds independently. All five are implemented and tested on the command path today — direct outbound mTLS transport, certificate-derived endpoint identity, Ed25519 signing, typed-operation execution, and Decision-Engine risk scoring sit between proposed work and endpoint execution, so a valid signed command still can’t skip the risk gate.
The mesh layer was retired by ADR 0021 rather than deferred. Enrollment-issued endpoint identity, mTLS-only gRPC, credential generations, renewal, and application-layer admission/lifecycle revocation are implemented. This is not a general CRL/OCSP service; production CA cutover, issuer adoption, and field acceptance remain R1 exit gates. We’d rather tell you exactly where the line is than round up.
Low risk runs. Critical risk waits for a senior approver.
The decision engine scores every proposed action across five dimensions — reversibility, blast radius, criticality, change category, confidence — into a single 0–205 score. The score decides the path:
Every action. Every actor. Every reason.
The audit trail is hash-chained — every entry’s hash is computed from the previous entry’s hash plus its own payload, so tampering breaks the chain instead of hiding in it.
Real event types, not paraphrases: drift.detected, decision.assessed, approval.requested/approved, command.authorized. When a client asks “what happened at 3AM?”, that’s the actual log you show them.
Enforced by Postgres, not by promises.
Row-level security is enabled and forced on nearly every tenant-scoped table. The application role carries NOBYPASSRLS — even a bug in our own code can’t cross tenants on the data that matters. A small number of operational-log tables hold pipeline metadata rather than client records and are the current documented exception. Missing tenant context otherwise returns zero rows, not all rows. Above that sits RBAC: two system roles and seven tenant roles, checked against every route. Deployment re-verifies effective privileges on those restricted tables after migrations and never grants table-wide CRUD, so an ACL regression fails the rollout instead of reaching production.
Triage can stay close to the endpoint.
The daemon includes a tiered local-LLM triage engine with signed model delivery and offline fallback. Health-aware provider routing, usage accounting and per-tenant daily and per-request USD cost caps are shipped; token-count ceilings are not claimed.
The agents get a boundary, too.
The newest control-plane modules treat AI behavior and tool authority as auditable operational state. They store bounded, redacted evidence, deterministic findings, compliance mappings, and governed action receipts under the same tenant isolation model as the rest of EliteMSP; they are foundations, not a claim of a hardened public MCP integration platform.