PyxGrant / Trust

Trust is a list of what we don't claim.

Security products lose trust when the brochure outruns the code. This page states what PyxGrant enforces, how to verify it yourself, and where the boundary is. The build fails if product copy crosses that boundary.

evidence chainlive

✓ Chain verified with your key

Each block carries the hash of the one before it. Change a record and every later link breaks.

Enforced in this build

Every error path denies. There is no fail-open branch.
The model is never the enforcement point.
Approvals bind to one argument hash, and an owner cannot approve their own agent.
Payments and irreversible tools need an independent observer signature.
Agents receive leases, not secrets. Static keys in a call are denied.
Every decision is signed, hash-chained, and copied to a second file.

Not claimed

Prompt injection is not solved. Detection covers known patterns and split-turn fragments. A successful injection still has to pass a checkpoint that does not trust the model.
No FIPS 140-3 validated module. Signing is software Ed25519. A configured HSM path that is missing makes decide return 503.
No FedRAMP authorization. The export is a readiness list with ato set to false.
No kernel probe. The collector reads known paths and process names.
No high availability yet. One host and one SQLite file, with a second chain copy on the same machine.
Not the only product in this space, and not a replacement for your EDR or IdP.

Coverage matrix

What reaches PyxGrant, and how.

PyxGrant can only decide what is routed to it. Each row says how a surface reaches it in this build and what happens at the edges.

Surface	How it reaches PyxGrant	Status
MCP tool calls	The MCP guard wraps each server	Enforced Denied calls are never forwarded, and a result that matches a known injection pattern is withheld. If PyxGrant is down, the guard stops forwarding.
Shell and file actions from coding agents	Runtime checkpoint: a CLI and local proxy on laptops and CI	Enforced if routed Writes resolve symlinks and paths are held to the workspace grant. Built-in agent tools that bypass both the checkpoint and MCP are not seen.
Secrets	Credential broker	Enforced Agents get a lease id, never the secret. A static key pasted into a call is refused.
Database queries	SQL proxy	Enforced if routed Restricted columns are masked for the caller's role. Queries sent straight to the database are not seen.
Your own agents and their model calls	Decision API	Your code asks Enforced when your code asks first and honors the answer. There is no drop-in model proxy yet.
Meeting bots, SaaS agents, phones, plant controllers	Reference connector endpoints	Your code asks The endpoints exist and call the same decision. No vendor-built connector ships yet.
Finding agents	Collector on laptops and CI runners	Observed Known config files and process names only. An agent that leaves neither is missed.
Sensitive data in prompts and tool calls	Pattern checks inside each decision	Partial Known formats such as keys, card numbers, and patient identifiers. Paraphrased data is not caught.
Prompt injection	Pattern and split-turn checks, plus session taint	Partial Known patterns and fragments across turns. Not solved. A successful injection still has to pass a checkpoint that does not trust the model.
Combined-call, cross-channel, and unadvertised-tool attacks	A risk flag set by the caller	Rule only The rules refuse these when the flag is set, but nothing in PyxGrant raises the flag yet.
Every file and syscall on the host	None	Not covered No kernel probe. Your EDR keeps this job.
Running through an outage	One host	Not built It fails closed, so an outage stops routed calls. High availability is not built yet.

Verify it yourself

You don't have to trust the appliance to check a receipt.

1. Get the key separately

Fetch the public key once and store it outside the appliance. Receipts do not carry the key, so a forged receipt cannot bring its own proof.

2. Check the signature

Canonical JSON minus the signature field, verified with Ed25519. POST /api/verify does the same check and returns false without your key.

3. Walk the chain

Each record's prev_hash is the previous record's evidence_hash. Compare the chain in SQLite with the second copy.

Data handling

What the appliance records, and what it doesn't.

Recorded

Agent and human identity
Tool name, argument hash, data class, and destination
Verdict, rule, reason, and cost
Request bodies with secrets redacted

Never done

Keystroke logging or screen recording
Productivity scoring or ranking developers
Emotion inference
Training on customer data