Policy is a promise. Whatever the model decides, it can do — and a tricked human can still be the one who clicks. Social engineering works by tricking a person into doing something they are allowed to do.
Policy is code. When host isolation, blocklist changes and destructive actions can only execute through a contract gate with tiered human authorization, a tricked human is no longer enough — the governed action still requires its prescribed authority to execute.
Enforced by the architecture: within the HexaBox-governed execution path, what the rules do not allow cannot execute. Not a promise — a hard gate.
The 19 HexaBox hard gates enforce, on every change, structural controls that map to NIS2, DORA, GDPR, the EU AI Act and ISO 27001 (CEVE-verified); regulatory compliance is determined per deployment, validated per vertical.
Every action — the AI's and yours — lands on a tamper-evident SHA-256 audit chain (HexaRecord) a regulator can verify. Every report leaves with the chain hash and how to verify it.
Block an external IP.
The record is the product — one chain from first signal to delivered report.
One chain per incident: the specialist's handoff, every gate decision, every approval, reclassification and close. The cockpit shows the chain intact or broken, entry by entry.
Drafted, reviewed, approved, delivered, acknowledged — every state on the record, never a silent overwrite. Sending is a T2 decision, T3 when the recipient is a regulator or a CSIRT.
Every agent's identity, doctrine score, drift and lease are attested and re-verifiable on demand. Signed, logged supply chain — verified with one command. CEVE 100/100 on the 19 doctrine gates, re-verified on every change.
Two layers, kept honest: a governance plane enforced and re-verifiable on every agent, and the domain standards each vertical additionally engages, with audit-ready evidence structure. The 19 HexaBox gates enforce, on every change, structural controls that map to these frameworks (CEVE-verified); regulatory compliance is determined per deployment, validated per vertical. HexaBox architects for these standards and ships the audit-ready evidence — it does not claim to be "certified" or "compliant". Certification is an accredited third-party audit; HexaBox provides the evidence, already inside the artifact and independently re-verifiable. A method built for regulated environments — cybersecurity, finance, healthcare, energy, public sector.
The AI-agent standard names six things a trustworthy agent must get right — HexaBox answers each with a mechanism: data & privacy (k-anonymous cohort contracts, PII gate) · security (port independence, zero-trust model calls) · safety (the CCAS tier ladder) · reliability (fail-closed degradation, per-port contracts) · accountability (hash-chained audit, signed agent identities) · society (sovereignty guard, egress controls). Certification is a third-party audit; the mapping is how the product is built to meet it.