367 autonomous agents and 205,034 non-human identities are a live attack surface. Every call they make is authenticated, policy-checked, and signed into a tamper-evident record — or it does not execute.
The directory holds 325,154 principals. Two-thirds are machines: service and agent identities that authenticate, call APIs, and write data around the clock. Ungoverned, each is an unattended credential inside your data plane.
Seven showcase agents run a 14-edge hand-off DAG; 360 fleet agents are mapped like-for-like to the Acme org across all 28 departments. Each is a registry tenant with its own capability secret and its own isolated data backend.
An agent cannot reach data on identity alone. The enforcement plane requires the tenant API key and a per-agent HS256 capability token the caller mints from its own 64-hex secret. Policy is deny-by-default; only on allow does the PEP forward — verbatim — to that agent's backend.
X-Tiresias-Api-Key identifies which of the 367 tenants is calling. No key, no evaluation.
X-Capability-Token: HS256, minted per call from the agent's 64-hex capability secret. Proves possession, not just identity.
The enforcement plane pulls the 367-agent tenant slice from the control plane, evaluates every governed request, and writes a signed record. The numbers below are read from the live stores, not a spec.
A runner mints the capability token; the PEP is the only door to data; the data plane re-validates the bearer; and Postgres enforces isolation at the row. Nothing reaches the store on a single unchecked assertion.
Each agent is a distinct soul-svc tenant keyed by sha512 of its bearer. Row-level security is FORCED on the memory and key tables, so even the database owner is subject to it. A cross-tenant read requires an explicit privilege escalation, not a bug.
SoulWatch watches how each agent behaves against its baseline. When an agent drifts, it is auto-quarantined into the shared quarantine store — pulled out of the run without a human in the loop — while the event streams to the SIEM.
SoulWatch scores behavioral drift per agent against its model baseline and trajectory.
Drift → auto-quarantine in the postgres quarantine store. The agent stops transacting immediately.
The PEP signs each governed request into an Ed25519 audit chain with a durable write-ahead log, then ships it to the control plane. Because entries are chained and signed, an altered or missing record is detectable — the audit is evidence, not a log you have to trust.
The control plane is in-network only; the PEP is the sole published data door; the data tier is a dedicated Cloud SQL instance reachable from authorized networks only. Compromising a runner does not hand an attacker the policy engine or the database.
| Plane | Where | Scope |
|---|---|---|
| Enforcement (PEP) | acme-demo :8343 | published |
| Control plane | tiresias-cp :8343 | in-network only |
| Identity store | postgres :5432 | in-network only |
| Data tier (acme_soul) | Cloud SQL :5432 | authorized-nets only |
| Directory | Samba-AD :636 | VPC (LDAPS) |
Because every call is metered into the usage store, the ROI board shows true per-model economics. Routing favors free and self-hosted tiers under policy; the expensive frontier models are reserved for escalation, and you can see the difference per call.
| Model tier | $/call observed | |
|---|---|---|
| opus-4.8 (frontier) | $0.19 | |
| sonnet-4.5 | $0.03 | |
| deepseek-v4-pro | $0.002 | |
| gpt-oss:120b (Ollama) | $0.0015 | |
| gemma-4-31b:free | $0.00 |
367 agents and 205,034 machine identities operate under two-factor call authentication, deny-by-default policy, forced tenant isolation, automatic drift quarantine, and a signed audit chain. Every action is authenticated, checked, and provable — or it does not happen.