Latency budget
Design targets per execution stage.
ingressroutepolicyauditegress
Self-hosted · Read the security model →
Cirvix is the runtime authorization layer for AI agents. Every tool call, API action, credential request, and consequential operation is evaluated against identity, policy, and context before execution. See how AI-agent security works at Cirvix.
The agent can reason. Cirvix decides whether it gets to act.
IdentityKnow who the agent is acting for.
AuthorityDefine exactly what it can do.
EnforcementStop unauthorized actions before they execute.
Request
- agent
- —
- action
- —
- environment
- —
- origin
- —
Editable. Try ~/.aws/credentials.
Pipeline
- parse
- normalize
- secret detection
- risk classification
- policy evaluation
- approval check
- sanitization
- audit event
Secrets and risk resolve before policy — a rule may test risk >= HIGH, so the value has to exist first.
total—
Decision
—
risk—
rules considered
Held for platform-oncall. The call is waiting, not failed.
audit
—
sha‑256 —
prev —
Quantitative architecture targets
0ms
target policy evaluation latency
0
unsanctioned payload data retention
0%
structural workspace scoping (org_id)
capability-vs-authority.mdCORE THESIS
Capability is not authority.
A model being capable of executing an action does not mean the agent is authorized to cause that consequence.
Frontier models (such as GPT-6 Astra) are reaching critical cyber-capability thresholds, discovering novel vulnerabilities and chaining multi-step exploits autonomously. Static allowlists and prompt guardrails fail. CIRVIX operates directly in the execution path, enforcing machine-speed (design-target <1.2ms authorization latency) against real-world side effects before actions run.
Controlled by design
System architecture
& execution flow.
Every agent action crosses a single control layer before it reaches a model, service, or database.
01 / Inputs
Client SDKsTyped execution events
Agent FrameworksBring your own runtime
WebhooksSigned external triggers
02 / Core engine
CONTROL ACTIVE
Cirvix Control Plane
Policy Enforcement Engine
Tamper-Evident Audit Logger
AES-256 Envelope Encryption
03 / Outputs
LLM ProvidersScoped model routing
External APIsSanctioned tool calls
DatabasesTenant-aware access
Control plane primitives
Built with
precision engineering.
A focused set of mechanics for operating AI agents in production without losing the evidence behind every decision.
Policy SDK
One evaluation call, one decision — hash-chained evidence, optionally Ed25519-signed (0.1.3+).
cirvix.policy.eval({
agent_id: "agent-01"
})Policy engine
Rules are live before execution.
deny-dotenv-read
active verdictDENY
Self-hosted deployment models
Keep the control plane inside the boundary that makes sense for your team.
Verifiable, not assumed
Enterprise security
architecture.
Built on engineering mechanisms you can inspect instead of unverified marketing claims.
AES-256-GCM envelope encryption
CIRVIX_MASTER_KEY is customer managed. No escrowed master key path.
Tamper-evident audit chain
Cryptographically linked SHA-256 logs preserve the integrity of each execution.
Structural tenant isolation
org_id row-scoping is enforced in routing rather than added as an application convention.
Zero unsanctioned retention
Decisions enter the audit chain; payload data is discarded when it is not approved for retention.
OIDC / SCIM support
Native integration points for enterprise identity providers and managed access.
Automated evidence generation
Export a coherent audit trail for a review without assembling raw logs by hand.
Cirvix enforces strict structural security mechanisms. Formal SOC2 and ISO certifications are currently in progress; we publish no unverified SLA claims. Cirvix is an independent, founder-led company (a sole proprietorship — see the terms) rather than an established enterprise vendor.
Start where you are
Six tiers.
One control plane.
MonthlyAnnual2 months free
Compare every feature, tier by tier
Enforcement is identical across tiers. What changes is coordination, identity, retention and deployment.
Early access
Free is free.
The waitlist is for the rest.
You do not need this list to start. npx @cirvix_ai/agent-control scan works now, needs no account, and sends nothing anywhere. The list is for early access to the paid tiers and the control plane, and for shaping what gets built next.
What Free actually gives you
- 100decisions per day. A refused call is not counted.
- 1agent, 1 seat.
- Localaudit chain, kept for the life of the deployment.
- Ephemeralsecret handles — they do not survive a restart.
- $0forever. No card, no expiry, no phone-home.
Over the daily limit, the call is denied rather than passed through unchecked. A security control that stops enforcing when a counter runs out is not a degraded product, it is an absent one.
Recorded.
You will hear from us when there is access to give, and not before. In the meantime the Free tier is the whole enforcement engine — npx @cirvix_ai/agent-control scan.
Documentation
Questions, answered.
The operational details matter. Here is a clear view of how Cirvix behaves under real constraints.
System statusEnvelope encryption uses AES-256-GCM. CIRVIX_MASTER_KEY remains customer managed and is never held in escrow by the service.
Cirvix can be deployed through Docker Compose, Helm, or directly on a Bare Node environment with the control plane inside your chosen network boundary.
Audit evidence is exported as structured JSON with linked execution records and SHA-256 hash metadata for each recorded decision.
Only approved decision evidence is committed to the audit chain. Unsanctioned payload data is discarded rather than stored for later use.
Govern what ships
Bring every agent
under control.
Set durable policy, preserve a verifiable record, and give teams a safer way to put intelligent systems to work.