CAIRN sits between an AI agent and anything it can affect — verifying, recording, and, where warranted, refusing. Every decision it makes is written to a hash-chained ledger that a reviewer can check without installing CAIRN, and without taking our word for any of it.
Every security and compliance review of an AI agent platform eventually asks the same question: does this platform actually enforce what the vendor says it enforces? Most answer with a policy document or demo — neither of which a reviewer can independently check.
Guidelines written in PDF governance packs. Code execution runs unchecked on host machines, and violations are discovered post-hoc in security audits or incident reviews.
Every tool invocation passes through an unbypassable choke point. If gate arguments error or schemas fail, the system fails closed into refusal. What cannot be verified simply does not run.
THE 4-TIER CAIRN SYSTEM
The stacked cairn symbol represents the physical architecture: from user intent down to cryptographic evidence. Each layer builds deterministically upon the foundations below it.
Schema validation, AST parsing, and prompt injection filters before code touches any system.
CAIRN (Blocking Gate)
PATH (Router)
Operator-declared autonomy ceilings, egress allow-listing, and secret redaction — evaluated in 0.20–0.26 ms.
COMPASS (Policy)
ATLAS (RAG Memory)
Dynamic hardware-isolated dispatch to Linux Docker or Windows Sandbox Hyper-V micro-VMs.
CRUCIBLE (Blocking Sandbox)
FORGE (Zero-Failure Loop)
Tamper-evident SQLite SHA-256 decision records, heartbeat gap tracking, and SIEM structured JSONL streams.
BEACON (Live Telemetry)
COMPASS (Audit Ledger)
Seven cooperating subsystems (PATH, CAIRN, COMPASS, ATLAS, FORGE, CRUCIBLE, BEACON) execute across the 4 physical stones bounded by a default-deny gate nothing bypasses.
Every recommendation and automated action is graded across 6 deterministic assurance tiers.
Raw LLM string or unparsed script.
AST syntax parsing and secret regex scan.
Ephemeral container run with read-only root.
Zero network egress & disk delta confirmed.
Identical output across multi-run seed tests.
Safely repeatable without state corruption.
These are grades an action is assigned, not stages every action passes through. Tier 2 and above require Docker or Windows Sandbox to be present; where neither is, the result is recorded as static-only with the reason, never downgraded silently to a pass.
The answers below are the ones an evaluation asks for early, and they are the answers CAIRN gives in writing rather than in a meeting.
CAIRN Trust Fabric is a deterministic enterprise trust plane inserted between user intent and model execution. While Large Language Models (LLMs) are probabilistic and prone to hallucination or prompt injection, CAIRN enforces default-deny governance, hardware-isolated sandbox verification, and SHA-256 decision ledgers.
CAIRN evaluates all tool calls through its schema-contracted pillars. The governance decisions (blocking, sandboxing, secret masking, and parameter schema enforcement) are 100% deterministic and evaluate in 0.20–0.26 ms without relying on secondary LLM judges.
No. No third party has audited CAIRN, no customer is running it in production, and it holds no certification — none is in progress. What exists instead is a published register of every claim with its limits, a signed evidence bundle a reviewer can verify without installing anything, and a build that refuses to package a version whose recorded commit is not the one it was built from.
For assurance tier 2 and above, yes — those tiers are defined by execution in an
isolated runtime, so without one they are unreachable. On a machine with neither, the
result is recorded as static_only together with the reason. It is never
silently downgraded to a pass, which is the distinction the assurance ladder exists to
hold.
No, and deliberately not. There is no push distribution, no heartbeat, no agent, no inbound connection from a node, and no remote revoke or reconfigure. Getting a signed policy to a node is the operator's own channel — a file, a share, an MDM. A node can export its evidence on a schedule to a directory you declare; CAIRN writes, and your organisation moves it.
Yes. "Windows protected your PC" — the binaries are not code-signed by a certificate authority. That warning means the publisher has not paid for an identity check, not that the file is dangerous. Every release ships a dependency-free verifier you can run before installing anything, and it proves the files have not changed since they were built. It does not prove who holds the key, and the download section says so.
Five requests from a real agent session. The verdict, the reason, the remedy and the timing are what CAIRN prints — and every decision is appended to the ledger below, hashed to the one before it, in your browser.
A refusal that only says what happened leaves an operator stuck. Each of these names the file to change and the decision they are making by changing it — which is the difference between a control that blocks work and one that governs it.
The decisions above were made on this page. This is a real evidence bundle — a vault driven through the real gates and exported by the real exporter, with the hash chain it shipped with. Your browser recomputes every hash on your machine; nothing here runs on a CAIRN server, because in a customer deployment there is none. Alter a record and the chain says so. Repair its hash and it still says so. There is no edit that leaves the chain intact, and you can prove that here rather than believe it.
The verification procedure is not ours to keep: it ships as VERIFY.md inside every
bundle CAIRN exports, and the code running on this page implements it verbatim. An auditor with
the bundle and openssl reaches the same answer without this site, without CAIRN,
and without trusting either.
Business Source License 1.1, converting to Apache 2.0 on 2030-08-23.
A security review of an agent platform asks the same four questions every time. These are the four, answered with mechanism rather than with assurance.
Local-first: no account, no CAIRN-operated server, no usage telemetry and no remote kill-switch. If you configure a cloud model provider, that provider receives what you route to it, and the egress policy decides what may be routed.
This proves the files have not changed since they were built and that the same key signed them as signed previous releases. It does not prove who holds that key — it is a self-published Ed25519 key, not a CA certificate. Compare the fingerprint the verifier prints against the one in the repository before trusting a first download.
