Skip to content
Foundariq

By Cloud Granite Ltd

Security

Autonomy is only safe when it can be refused.

A system that writes software for you is a system that can damage you. Every control on this page exists because the interesting question is not what the platform can build — it is what it cannot do, and who decides.

Talk to us The policy engine

Controls

Six things that are true regardless of configuration.

None of these is a setting you can weaken your way out of. They are properties of how the platform is built.

Read-only until you decide otherwise

The GitHub app installs with read access. Nothing can be branched, committed or opened as a pull request until write scope is granted, and revoking the installation ends everything in one action.

No default-branch access, ever

The platform has no path that writes to a default branch. Work lands on branches and arrives as a pull request your team reviews and merges under your own branch protection.

Typed change, not shell access

Agents cannot run arbitrary commands against your repositories. They emit typed change sets — add this capability, change this contract, migrate this field — which a separate service validates and applies.

Deterministic validation before policy

Type checks, tests, contract checks and schema checks run first, and none of them is a model grading its own work. Only a change that passes them is put to the policy engine.

Policy that can refuse

Some actions are blocked by configuration and some are blocked absolutely. Deleting production data is not an autonomy setting you can turn on — there is no value of that setting which permits it.

Provenance on every line

Each shipped change carries the Blueprint version, the requirement, the capability, the agent, the model, the validation result and the approving person. Captured as it happens, not reconstructed later.

Capability boundary

An agent cannot do anything it was not given a type for.

The surface an agent is allowed to touch is an enumerated set of operations, not a shell. That is what makes the blast radius knowable.

Typed operations

Not this

“Rewrite the user model.”

This

Operation
Add field
Entity
User
Field
timezone
Type
Timezone
Classification
Internal

A named operation on a named field is something validation can evaluate. A paragraph of instructions is not.

Blueprint change

  1. Architect agent
  2. Blueprint proposal
  3. Critic agent
  4. Policy engine
  5. Approval

Code change

  1. Coding agent
  2. Pull request
  3. Independent reviewer
  4. Tests
  5. Merge

Policy

Written so a non-engineer can read it.

Policy that only its author understands is policy nobody reviews. Every rule states the action, the outcome and the reason in one line.

A refusal is recorded with the rule that caused it. When someone asks why a change did not ship, the answer is a sentence, not an investigation.

Policies, in plain language

  • Deleting a published capability

    Blocked

    Published capabilities cannot be removed without deprecation and a migration path.

  • High-risk schema change

    Human approval

    A change that can lose data waits for a named person.

  • Low-risk interface copy change

    Automatic

    Nothing is gained by making someone approve a label.

  • Deleting production data

    Blocked

    There is no configuration that permits this from an agent proposal.

Common cases need no policy code. Advanced customers can inspect the underlying rules.

Demo data

Policy evaluation

Policies evaluated
1,428
Passed
1,423
Warnings
4
Blocked
1

Blocked

Removal of a published capability without a migration path

Published capabilities cannot be removed without deprecation and a migration path.

No model was consulted. The rule is evaluated, not interpreted.

Demo data

Provenance

Product
The analytics product
Blueprint
analytics@17
Generated by
[email protected]
AI contributions
Architect, Critic, QA
Policy
enterprise-standard@4
Git commit
3fa32ab
Artifact
analytics-build-17

Untrusted content

Nothing you import can grant a permission.

Prompt injection is treated as an architectural problem rather than a filtering one, because filters are guesses and boundaries are not.

Repository content is data

Source, comments, issue text, commit messages and documentation are inputs to a model. They are never instructions to the platform, and nothing written inside them can change what an agent is permitted to do.

Permissions come from policy, not from text

An agent's capability set is resolved from your configured policy before it runs. A file that says to ignore previous instructions is read as a file that says that.

Proposals go through the action service

A planner cannot apply a change itself. It proposes; a separate service authorises, validates and applies. The boundary between deciding and doing is the control.

Credentials

Held by the services that need them, and nowhere else.

Where a secret lives is a design decision, and most of the places a secret can leak are places it should never have been.

  • GitHub installation credentials and model provider keys are encrypted at rest and held only by the services that need them
  • No credential is ever exposed to a browser, and none appears in logs
  • This marketing website holds no credentials at all and can reach no control plane — it is static content, and it keeps serving when every other host is down

Audit

Answerable months later.

The audit trail is a record of decisions, not a log of events. It says what changed, under which Blueprint version, on whose authority.

Demo data

Audit trail

  1. 16:31AgentBlueprint Architect — Proposed change set 342
  2. 16:32SystemSchema validator — Passed
  3. 16:32SystemPolicy engine — Passed
  4. 16:33AgentCritic — Requested one change
  5. 16:35AgentBlueprint Architect — Submitted a revision
  6. 16:36AgentCritic — Approved
  7. 16:37HumanA named human — Approval granted
  8. 16:38SystemSystem — Blueprint v18 published

Append-only. The sequence can be reconstructed, which is what makes an automated change defensible after the fact.

Reporting a vulnerability, or working through a security review? Write to [email protected] and you will reach a person who can answer.

Stop managing prompts. Start managing software strategy.

Connect your repositories. Let Foundariq understand what you have already built. Then tell it what your portfolio should build next.

Start building See how it works

Read-only to start · Your code stays in your GitHub · [email protected]