Breach is the premise.
Containment is the architecture.

BluVi's open-source commitment to protecting humans.
Bad actors exist. Unintended consequences happen. Guardrails aren't optional — they're overdue.

An open, vendor-neutral security architecture for autonomous AI agents. Not another framework. An enforcement layer.

Status: Open RFC (v0.9)

AI agents can reason, plan, and act.
When one gets compromised, it doesn't
just leak data — it takes actions.

Sends money. Changes systems. Makes decisions. All with its own authorized permissions, at machine speed, across every connected system.

Traditional compromise = data loss. Agent compromise = autonomous action at scale using its own authorized permissions. Unauthorized transactions, privilege escalation through persuasion, cascading failures across connected systems.

Want to see this in action? Real attack scenarios showing where current approaches stop and what happens without enforcement.

Explore attack scenarios →

The architecture wasn't built for
an AI agent that is compromised.

OWASP, MITRE, NIST, Cisco, and the major vendors catalog threats, deploy guardrails, and monitor agent behavior.

They still trust the agent to cooperate with their own security controls.

Capability Traditional
Zero Trust
Prompt
Filters
Credential
Proxy (IAM)
Agent Identity
Products
ZoD
Pre-reasoning input screening
Reasoning / execution separation ~
Short-lived credential management ~
Agent identity and lifecycle ~
Continuous behavioral monitoring ~ ~
Risk-weighted human escalation ~
Insider / policy-author defense ~ ~
Parameter-bound token enforcement ~
Semantic intent policy enforcement
Memory audit (external, systematic)
Behavioral baseline integrity
Immutable integrity signal channel
Cross-layer correlation detection
Multi-agent chain-of-custody ~
Formal degradation model

✓ = core capability   ~ = partial/ad-hoc   — = absent  |  Source: ZoD Cross-Reference Mapping

See where ZoD enforcement begins →

The Seven-Layer Architecture

Because the agent that reasons should never be the process that executes privileged actions. Each layer assumes the layer above it has already been compromised.

L1

OS Foundation

Attacker targets agent credentials and process isolation

Agent identity, process isolation, credential brokering, model provenance attestation. The agent never sees raw secrets — credentials are brokered at the OS level.

L2

Input Control

Attacker poisons input — emails, docs, API responses, prompt injection, context window manipulation

Adversarial screening for prompt injection, persuasion, context window manipulation, and embedded instructions. But screening isn't perfect — so every layer below assumes it already failed.

L3

Cognitive Isolation

Compromised agent tries to execute privileged actions directly

Agent can reason but cannot act. Reasoning and execution are separate processes with a hard boundary. All outputs are proposals, not commands.

L4

Request Validation (CA)

Agent crafts a valid-looking request to misuse its own authorized tools

Independent Certificate Authority evaluates against scope, baseline, risk, and semantic intent. Token-bound, parameter-locked, single-use. The agent can't learn its own constraints.

L5

Execution

Validated action gets tampered with during execution

Isolated process performs validated actions. Agent has no access. Cryptographically signed results with immutable provenance. Every action logged immutably.

L6

Continuous Monitoring

Subtle behavioral drift goes undetected across sessions

Behavioral baselining, drift detection, memory audit, baseline integrity verification. No layer reports its own status — the integrity channel is independent and immutable.

L7

Human Governance

High-risk action should require human judgment

Risk-weighted escalation — not optional oversight. High-risk actions physically cannot execute without human authorization. Policy flows down through the entire stack.

ZoD is an architectural model, not a latency guarantee. Implementations may collapse or optimize layers, but the enforcement boundaries remain conceptually distinct. The minimum safe configuration requires L3–L5 separation, token-bound execution, and immutable logging.

Ready to go deeper? Full specification — threat model, layer interactions, degradation modes, trust assumptions, and framework cross-reference mapping.

Read the draft spec on GitHub →

It completes the landscape.
It doesn't compete with it.

ZoD is not a replacement for OWASP, MITRE, or NIST. It's the enforcement layer those frameworks assume exists but never define.

IDENTIFY
Threat Taxonomies
OWASP, MITRE ATLAS, ATT&CK, Cisco, CSA MAESTRO
GOVERN
Lifecycle & Compliance
NIST AI RMF, ISO 42001, EU AI Act, SOC 2, Google SAIF
DEPLOY
Point Solutions
Entra Agent ID, Cisco AI Defense, CyberArk, Aembit, Zenity, Palo Alto
CONNECT
Discovery & Interop
Google A2A, Anthropic MCP, OWASP ANS, IETF WIMSE
VERIFY
Trust Infrastructure
SPIFFE/SPIRE, Sigstore, Agent PKI, Zero Trust
ENFORCE

Zones of Distrust

Architectural enforcement. The runtime defense that makes identified risks into contained failures. Where policy becomes physics.

See the full picture. Explore how ZoD fits alongside every major framework, vendor solution, and protocol in an interactive landscape overview.

Explore ZoD →

What This Is / What This Isn't

What This Is

  • A reference architecture and threat model for agentic AI
  • A vocabulary and layering model teams can implement incrementally
  • A foundation for research, tooling, and standards alignment
  • Complementary to Zero Trust — extending proven principles to AI agents

What This Is Not

  • A product
  • A control-plane implementation
  • A replacement for Zero Trust, IAM, or MLOps
  • A complete solution — implementations require judgment

Help Wanted.

The whitepaper is drafted. The architecture is in RFC. Agents are shipping faster than the security architecture to contain them.

What's missing is you — breaking it, extending it, proving it wrong so we can deploy what's right.