Security and governance by design.
AI advises. Policy authorizes. WAIOS executes. BlackBox proves. Backend policy—not an AI prompt—determines whether an action may execute.
Authority remains explicit
Autonomy does not remove authority.
The AI does not grant itself authority, cannot bypass policy, and cannot decide that its own output is permission to execute. The backend evaluates whether a proposed action is allowed.
Security architecture
Identity & Access
Scoped, revocable cloud-native permissions. No permanent root credentials as the target architecture.
Human-in-the-Loop
Sensitive actions remain behind a Human-in-the-Loop approval gate. Identity-bound enterprise approver controls and tenant-scoped RBAC are in development.
Encryption
Current verified Forensic BlackBox records use AWS KMS encryption at rest.
Auditability
Detection, risk, authority, remediation, rollback, verification, and outcome can produce evidence.
Tenant Isolation
Designed to be enforced by identity, authorization, policy, and the data layer—never by an AI prompt.
Business Continuity
Restore point and rollback foundations are verified; broader DR controls continue to expand.
External enterprise onboarding gate
Tenant isolation and identity-bound authorization / RBAC are blockers for external enterprise onboarding. They must be implemented and verified before separate customer Spokes are connected. WAI Ecosystem remains the internal reference environment.
Tenant A identity → Tenant A policy → Tenant A CMDB → Tenant A credentials → Tenant A execution → Tenant A BlackBox
Each tenant requires this complete boundary. AI reasoning, retrieval, execution context, and operational evidence must remain within the authenticated tenant and authorized role scope, including CMDB, BlackBox, and KEDB access. Identity, authorization, policy, and data-layer controls must enforce isolation; an AI prompt cannot provide it.
Responsible AI
AI must never receive data outside the authenticated tenant and authorized role scope. Tenant-scoped RBAC and isolation are architecture requirements currently in development.
Every autonomous action should leave evidence
BlackBox is the historical operational record for detection, affected resources, risk, recommendations, authority, remediation, rollback, verification, and outcomes. CMDB tells WAIOS what is true now. BlackBox proves what happened.
Verified KMS-encrypted forensic evidence. WAIOS does not claim full immutability or WORM protection. Object Lock, WORM retention, legal hold, and cryptographic integrity verification remain roadmap.
Compliance mapping
WAIOS supports implementation and evidence collection for selected controls. The mapping below is limited to currently supported foundations and does not represent certification.
| Framework | Control area | WAIOS capability | Evidence status |
|---|---|---|---|
| ISO/IEC 27001 | Access · encryption · logging · change governance | Scoped access foundation, KMS-encrypted BlackBox, policy and approval evidence | Live / verified foundation |
| ISO/IEC 20000-1 | Incident · problem · change · service operations | Autonomous CMDB, governed remediation, Problem Management and KEDB | Live / verified foundation |
| ISO 22301 | Restore · rollback · failover · recovery | Restore and rollback foundation; DR control expansion | Verified / in development |
Control mapping and automation do not constitute formal certification. Certification is a separate independent assessment process.
Public disclosure boundary
Public materials explain system boundaries, data flow, authority, status, and security principles. They intentionally exclude exact IAM policies, role ARNs, account identifiers, internal schemas, risk formulas, orchestration logic, remediation algorithms, prompts, secrets, and security-sensitive APIs.
Found a security issue?
Contact the team privately without publishing sensitive details.
Contact Security