Zero-trust for every workload, every cloud, every agent

A workload identity is a principal, like a user, service account or group. Policies name it and the audit trail attributes every action to it. It works with or without a connected cloud account. Connect one and the identity carries least-privilege rules for that provider, and the workload gets short-lived credentials at runtime instead of storing any. An identity is scoped to a single Global Virtual Cloud (GVC™).

Every workload has a firewall that denies all traffic until you allow it. Every service-to-service call goes through a mesh with per-workload client certificates rotated hourly. Every principal (user, service account, group or workload identity) gets only what a policy grants, whether it is a person or an AI agent.

Policies map actions (create, edit, delete, and more) on specific resources to users, service accounts, groups, or identities. AI agents like Claude Code are principals under the same policies, so an agent gets the same least privilege as a person.

An immutable record of every resource mutation, from any interface (UI, API, CLI, Terraform, MCP) and any actor, human or AI agent. Filter by resource type, audit context, name or ID, subject, and date range. A diff view shows exactly what changed. Each entry has the timestamp, resource name and kind, version, result, subject with IP address and authentication attributes, and the raw event JSON.

Encrypted at rest, injected at runtime as environment variables or mounted files through the workload's identity, scoped by policy. Types for AWS, Azure, GCP, Docker, ECR, NATS, and TLS, plus opaque, dictionary, keypair, and username/password.