Secure AI for essential infrastructure.

The threat model nobody writes down

Most AI security conversations orbit the model: adversarial examples, prompt injection, weight extraction. Those are real, but in infrastructure the more probable failures are older and plainer. Telemetry can be spoofed, and a model that trusts its inputs will faithfully automate a lie. A credential can leak, and whatever that credential can reach, an attacker can reach through it. An integration partner can be compromised, and data that crossed the boundary without verification becomes an open door. A model is one component in that landscape, and rarely the weakest one. The security question that matters is not "can the model be fooled" but "what happens downstream when it is".

Input integrity before intelligence

An AI system inherits the integrity of its inputs, so we spend security effort where the data enters. Field capture is encrypted on device and sealed with a hash chain, so a record arriving at the platform can demonstrate it was not altered between capture and sync. Telemetry is evaluated for physical plausibility before it is used: readings that violate the physics of the site are quarantined as suspect rather than averaged into the record. Inference over incomplete or suspect inputs degrades explicitly, because the no-fabrication rule is also a security control: a system that refuses to invent values is a system an attacker cannot steer by starving it of data.

The envelope is the blast radius

The most important security property of a deployed model is the size of its blast radius when everything else fails. Our models run inside deterministic envelopes with deny-by-default authority: a model can influence only the actions explicitly granted to it, enforced at the database row, not in application code. It cannot move money, because financial writes require ledger entries with idempotency keys that no inference path produces. It cannot bypass the human authority on consequential steps. When a model is compromised, confused or simply wrong, the envelope converts a potential incident into a bad recommendation that a person declines, which is the correct worst case for infrastructure.

Secure AI is boring on purpose

Row-level security, schema-per-tenant isolation, append-only audit, encrypted devices, verified inputs, bounded authority. None of this is novel AI safety research, and that is the point. The systems that keep power flowing and records defensible are secured by controls that are old, testable and dull, applied without exception to the newest components. We treat any AI capability that cannot live inside those controls as not ready for production, however impressive its accuracy, because in essential services the model is never the asset being protected. The infrastructure is.