One box per site. Nothing shared.
On-site appliance
A dedicated Guardian box on a management VLAN runs the AI model, tools, vault and audit trail. Docker packages it; isolation comes from the hardware.
Outbound only
The box connects out to the portal over an encrypted channel. You open no inbound firewall ports.
Portal holds no secrets
Approvals and summaries only. No client credentials, no raw logs. A fully on-site portal option is planned for enterprise.
Vault-issued credentials
Short-lived credentials are issued per step and revoked straight after. The AI never sees a plaintext password.
Kill switch
One action revokes every credential Guardian holds. If the AI is unavailable, monitoring and the audit trail carry on and all actions stop.
Tested first
The permission engine and audit log are built test-first and independently security-reviewed, with every finding fixed before moving on.
Logs are evidence. Never instructions.
Attackers can plant text in logs, emails and filenames that Guardian reads. That content is treated strictly as data. A request that came from an untrusted channel can never run on Auto, and the exam includes planted traps that a model must ignore to pass.
Trust is granted, never assumed.
Device groups come from your inventory, not from the AI. Emergencies are declared by triage rules, not by the model. Approvals are single-use and tied to the exact settings approved. Guardian can lower its own autonomy but can never raise it.