Every control your reviewers ask about maps to a mechanism in the platform, not a promise on a slide. Self-hosted, air-gapped, or hosted by Daybreak Labs; an egress lock, capability tokens, dual control, a policy on every action, and a signed, hash-chained audit you can verify offline.
What a security reviewer requires, and the mechanism in the platform that satisfies it.
| What your reviewers require | The mechanism |
|---|---|
| Your data stays inside your boundary | Self-host or air-gap in your VPC or fully offline, or run on Daybreak-hosted infrastructure with tenant isolation and your own keys (KMS / BYOK). |
| Egress locked by policy | Egress lock (Enterprise mode): outbound traffic is allow-listed per tenant, model calls and HTTP tools alike, so a successful prompt injection still can't move data out that way. Pair with a network egress firewall to also cover raw-shell paths. |
| Least privilege, per action | Capability tokens (attenuate-only): an agent narrows its rights, never widens. |
| Separation of duties | Dual control: the person who initiates an action can never be the one who approves it. N-of-M sign-off, enforced. |
| Bounded blast radius | Sandbox, network-off by default · hard budget caps on tokens, dollars, wall-clock, and tools. |
| A human stays in control | Policy on every action: allow, deny, or require a human. |
| A provable, tamper-evident record | Signed, hash-chained audit (the Operating Record): tamper-evident, verifiable offline. |
| Evidence on demand | Proof Pack: an Ed25519-signed bundle that verifies offline and refuses to fabricate. |
| Provable safety posture in CI | A machine-readable safety report: shield, sandbox isolation, and egress policy as an assertion your pipeline can gate on. |
| Your data trains no one's model | Tenant-exact, never pooled: your Cortex and your record are encrypted with your own keys and are never read by, trained on, or aggregated with another customer's. No hivemind, no telemetry, no pooled data. |
Six load-bearing governance invariants are checked across every specialist pack, then property-fuzzed with extensive randomized iterations and a non-vacuity control, so a passing result can't be vacuously true.
Fig. 07 · The invariant run. Each line is a property that must hold for every pack; the non-vacuity control proves the checker can fail, so a green result means something.
Self-hosted, air-gapped, or hosted by Daybreak Labs: log in and go. The same gates, the same record, and your own keys, whichever you choose.
Your VPC: your cloud account, your keys, on the stack you already run. Nothing routes through us.
Fully offline, with a one-command readiness check. The platform never has to reach the network.
Log in and go. Tenant isolation, your own keys via KMS / BYOK, and the same gates and the same record as the other two.
Self-hosted and air-gapped deployments run on Docker, Kubernetes, or a single VPS. Every option integrates with Salesforce and ServiceNow over the MCP server.
The Operating Record is a signed, hash-chained log of every governed action. Each entry signs the one before it. Alter a single row after the fact and the chain breaks, so tampering is detected, not assumed away.
The Proof Pack is an Ed25519-signed evidence bundle: it verifies offline and refuses to fabricate a result it cannot prove.
The controls above map to the expectations behind the frameworks regulated teams report against. Lightwork is in alpha; we present control-mapping rather than badges.
We map your security questionnaire to the platform, control by control.
We'll map it to the platform, control by control.
