The technology
A new security architecture for the AI era. Security is built around identity, not location — from getting in, to running software, to what an AI agent may do.
Constrain authority·Contain AI·Remove the attack surface
The challenge
AI has turned cyberattack into an automatic, machine-speed activity — what once took skilled people days now runs on its own, around the clock. So there are two things to defend against at once: outside attackers, and software that acts on its own.
The answer
One idea ties the three together: security follows identity — from getting in, to running software, to what an AI agent may do.
Prove control of a recognized identity with cryptographically verifiable signatures — before anything connects.
Give each application or AI agent only the power it truly needs, and nothing more.
Hide what matters completely — a vault an intruder cannot even find.
Precisely: a protected service exposes no directly reachable inbound path to an unauthorized internet client. "Nothing to find" is the plain-language shorthand for that testable property.
How to picture it
You don’t close the branch to protect the vault. You stay open for business — and make the vault impossible to find. What stands between the two is a clerk.
The mechanism
It is the point where an identity, the owner’s trust decision, and the protected service meet — and the owner decides who is trusted, not a central authority and not us. “I do not entertain everyone; only the one I trust can find me, and only the one I trust will I serve.”
Underneath, that makes it a new breed of router. Ordinary networking exposes a destination and lets the outside push connection requests at it. Enclave reverses the direction: the protected endpoint stays hidden, and the trusted side pulls in only what has already been identified and authorized.
Precisely: zero public ports; identity-resolved services for authorized users. From the public network, no unauthenticated inbound service is reachable. For an authorized identity, many policy-authorized logical services resolve without any of them exposing a physical port. This is not deception — nothing is pretending to be open, and there is no tarpit to fingerprint.
Ordinary routers route traffic. Enclave routes trust.
Your service is not public and guarded. It is private, and revealed only to the identities you choose to trust.
In productionThis is the layer the recorded penetration test exercised — see Evidence. It is what Osmo puts around the systems you already run.
The architecture
Staying invisible is only the first step. The same identity keeps control at every step after it.
Accountable authority
A wall does nothing if the stranger is already inside with a key — a stolen credential, or an agent that goes wrong using access you handed it yourself. SIF’s answer is to make authority explicit and every action attributable afterward: identity tells you which agent acted, and the chain tells you who authorized it and what evidence it left behind.
“Nothing anonymous” does not mean we know who you are in the world. It means the system does not accept an unaccountable actor: an identity can be pseudonymous and still be persistent, recognizable, and carry its own history — so anyone deciding whether to trust it can look at that history and judge for themselves.
In four lines
Against today's best practice
Today’s leading zero-trust products all make a server unreachable and gate it by identity — that’s the zero-trust baseline (the shaded rows), and Enclave meets it in production today. Read past them: today’s best practice stops at who can get in; SIF keeps going — to what software and AI can do once inside, and who is accountable for it.
| Dimension | Open-source overlay | Enterprise ZTNA appliance | Global edge cloud | Owl One SIF |
|---|---|---|---|---|
| No inbound listening port (server is "dark") | ✓ Yes | ✓ Yes | ✓ Yes (tunnel) | ✓ Yes |
| Access gated by cryptographic identity | ✓ X.509 via controller | ✓ IdP + endpoint agent | ✓ via external IdP | ✓ Yes |
| Trust path in the middle | Central controller + edge routers | Vendor gateway + vendor SASE cloud | The provider's global edge cloud | ✓ Broker-less, decentralized mesh |
| Where identity comes from | Issued by the controller (central PKI) | Central IdP + endpoint agent | External IdP | ✓ Self-authenticating identifier |
| How far trust reaches | ✗ Network access | ✗ Network access + device posture | ✗ Network access + SASE (gateway, CASB) | ✓ Network → runtime → AI-agent authority |
| Accountable AI — who authorized the agent | ✗ Not a focus | ✗ Not a focus | ✗ Not a focus | ✓ Core: verifiable human-to-action authority chain |
| Deployment & data sovereignty | Self-host, or the vendor's cloud | Appliance + US-based cloud | ✗ US-based global cloud (required) | ✓ On-prem / sovereign |
| Ownership | Open source, US-based steward | US public company | US public company | ✓ Canadian company; owns the IP |
Baseline rows (shaded) are table stakes across zero-trust — no invention claimed there. Sources: published vendor documentation.
Two products, two jobs
Sovereign Identity Fabric is the foundation. Osmo and Prime are the two products that sit on it — and everything Prime does happens inside the line Osmo draws.
