Tell us what you are trying to control.

IAM answers who may call. Cirvix answers whether this specific action may run — scope, sequence, approvals — and records the decision in the hash-chained log (optionally Ed25519-signed since 0.1.3). A compromised directory account carries its approval authority with it, which is why this complements your identity provider and replaces nothing. See the threat model.

Filters flag bad text after the fact; Cirvix enforces a boundary before the action, so the block holds regardless of what fooled the model. It does not detect prompt injection itself — the sanitiser is a mitigation, the policy engine is the control. See security.

A gateway covers the path that passes through it, in one protocol. Agents act through MCP, REST, CLI, browser automation, sub-agents, and local calls — Cirvix judges the action regardless of channel, fails closed, and keeps the decision record. If every agent you run speaks only MCP through one gateway, say so in the form above; we will tell you if the gateway is enough. See architecture.

A mesh governs traffic between services. Agent risk sits inside the process: which file, whose credential, what sequence, which sub-agent grant. Different layer — a mesh gives you no per-action verdict, no approval hold, and no hash-linked decision record.

A sandbox shrinks the blast radius; it does not decide per action, broker secrets, or produce evidence. Anything the agent legitimately needs — credentials, production data — must still cross the boundary, and Cirvix hands out handles instead of secrets. The two compose; neither replaces the other.

That is the adversary the product exists for, and it assumes a prompt-injected agent. Capability is not authority: every tool call is still evaluated and deniable. The ceiling is honest — an action your policy allows will run even if the motive was injected, so policy quality is the control surface. See threat model and policy engine.

It denies. Engine unreachable, audit store unavailable, quota exhausted — all refuse, with the denial recorded and its cause attached. A control plane that fails open is not a control plane. See evaluation answer 03.

There is one control layer and no bypass path: unmatched actions are denied, and audit_only never authorizes. The limits are stated, not buried — root on the endpoint is outside any userspace product's model, an operator who can edit the database and recompute the chain can rewrite history (the chain proves tampering only to someone holding an earlier head), and the free tier's local counter is honour-system metering. See threat model.

No. Payload contents are discarded unless explicitly approved for retention; the record holds decisions, not data. The master key is customer-managed with no escrow path, so there is no mechanism by which the vendor decrypts on your behalf. Self-hosted deployments keep everything inside your boundary. See retention.

Decision records live for the life of the deployment. Nothing prunes the local chain — retention is bounded by your own store, not ours. See retention.

Self-hosted means you run the daemon, sidecar, or Compose stack inside your boundary — documented today, starting with a Free install that sends nothing anywhere and needs no account. Air-gapped, with no outside connectivity at all, is an Enterprise scoping exercise: keys, identity, distribution, and updates all change, and it is quoted per deployment. Scope it with the form above. See deployment.

No. Both are in progress; we do not describe ourselves as certified or compliant, and coverage reports contain no word for "compliant" by design. No uptime SLA is published — availability terms are contractual per Enterprise deployment — and no third-party penetration test has been published; the adversarial review we cite is self-attested (see verification). Cirvix is also a founder-run sole proprietorship rather than an established enterprise vendor — weigh that the same way. Evidence export is available now.