ASAF Runtime · Privileged Governance Kernel

What stops an AI agent when it can't prove an action is safe? ASAF says no.

ASAF checks, runs, verifies, and signs every action your AI agents take. If something goes wrong, it reverses the action on its own. It runs inside your own walls, even fully offline. It never defaults to yes.

Short answer

ASAF is a privileged governance kernel that checks every AI agent action before it runs, signs it with ML-DSA-65, and reverses it automatically if something breaks. It fails closed by default and can run fully offline inside your own walls.

By Yao Nouchi, Founder & Principal Engineer, SecRed Knowledge Inc.U.S. Army veteran · Active DoD Secret clearance · CMMC & STIG practitionerLast updated August 2026

Last updated August 2026

Layer model

What stands between your data and a rogue agent?

ASAF does six jobs: it checks permission, runs the action safely, checks the result matches what was promised, signs it (ML-DSA-65, a crypto lock even quantum computers can't break), undoes it if something breaks, and keeps rechecking forever.

Kernel model
The system that decides yes or no
Execution
Blocks by default, undoes mistakes fast
Attestation
Every action signed and locked
Sovereignty
Runs fully offline, stays in your walls
L7
Applications
AdinKhepra · SouHimBou AI · partner apps
L6
Evidence & Replay
Auditor portal, incident replay, GRC exporters
L5
DAG Attestation
Append-only, hash-linked, tamper-evident
L4
Provenance
Lineage, input/output hashes, causal graph
L3
Policy
OPA/Rego bundles, obligations, quorum
L2
Runtime
Sandboxed agents, mediated I/O, sessions
L1
PQC Identity
Hybrid ML-DSA + Ed25519, HSM roots
L0
Connectors
Signed manifests, capability scopes
Governance Graph

How do you prove an AI action can't be erased?

Each step an agent takes, from asking permission to finishing the job, gets locked to the one before it. Nothing gets deleted. Nothing gets faked.

IdentityPolicyRuntimeConnectorAgentToolProvenanceDAGAttestation
Rules that never bend
Bounded privilege

No agent gets a blank check. Every permission is limited and controlled by the kernel.

Fail-closed

When in doubt, it says no. If anything is unclear, the action is blocked.

Canonical serialization

Every record is built the same way every time, so anyone can check it and get the same answer.

Independent replay

You can replay the whole chain of events yourself. You don't have to trust us.

Sovereign deployment

Runs the same on your own servers, Kubernetes, SSH, or a local machine. No cloud needed.

Post-quantum

Locked with ML-DSA-65, a signature future quantum computers can't crack. Built to swap in new locks later.

Deployment topology

How much control should you keep? We recommend all of it.

Regulated
Sovereign

Everything runs inside your own walls, even fully offline. You get your own checker tool too. Best choice if you handle CUI, ITAR, or other regulated data.

Recommended
Hybrid

KHEPRA manages the controls. ASAF and your evidence stay in your own cloud. You hold the keys.

PoC
Validation adapters

Optional outside tools (like HackerAI) used just to test and prove ASAF works. Never required to run it.

Questions people ask about ASAF

What does ASAF do when it can't confirm an action is safe?

It says no. ASAF fails closed by default, so any unclear or unverified AI action is blocked instead of allowed through on a guess.

What are the six checks ASAF runs on every action?

It checks permission, runs the action safely, checks the result matches what was promised, signs it with ML-DSA-65, undoes it if something breaks, and keeps rechecking forever.

Can ASAF run fully offline, on my own servers?

Yes. ASAF runs the same on your own servers, Kubernetes, SSH, or a local machine, even fully offline. No cloud is required for sovereign deployments.

Can I verify ASAF's records myself, without trusting KHEPRA?

Yes. Every record is built the same way every time and can be independently replayed. You don't have to take our word for it.

Is ASAF's signing protected against quantum computers?

Yes. Every action is locked with ML-DSA-65, a post-quantum signature that today's or tomorrow's quantum computers can't break, and it's built to swap in new locks later.

What deployment options does ASAF offer?

Sovereign (fully in your own walls, best for CUI or ITAR data), Hybrid (KHEPRA manages controls, you hold the keys), and Validation adapters for outside tools like HackerAI to test and prove it works.