Security architecture and honest limits.

Vortalis does not solve reliable goal-drift detection as a general research problem: the proxy decides individual actions at the boundary rather than scoring the trajectory those actions trace over time, and this remains true. The operator gets a complete per-session audit chain as forensic evidence, and sets the policy and kill-switch boundaries that cap how far any single action can reach, so a drifting agent is still constrained action by action even where the general drift pattern itself is not flagged. Vortalis is building specific, narrowly-scoped mechanisms that measure drift within a bounded frame (for example, the delta between a session's declared intent and its actual action stream); each is stated together with what it measures and its explicit limit wherever it appears, and none is a claim to have solved goal-drift generally.

Vortalis does not promise to defeat an adversary that models the proxy and adapts to it. A determined attacker can probe the denial surface and tune its behaviour against the responses it sees, and no static policy closes that gap completely. Vortalis raises the cost of the attack: denial reasons are sealed to the agent and visible only in the operator audit chain, and rate limits starve the attacker of the training signal it needs to fit the policy. The operator runs continuous detector retraining so the defence improves over time rather than standing still against a moving adversary.

Vortalis does not detect two agents coordinating through a neutral third service that records no delegation between them, in the general case. Where enabled, the joint-action evaluator matches correlated actions across the recent per-tenant audit history, so where a prior delegated action appears in the window the second action can be denied, but coordination through shared mutable state on an unrelated system leaves nothing correlated for it to match. New tenants are enabled for it by default on the synchronous evaluator, which blocks at the boundary. An off-hot-path async recording path, which records a governance outcome after the action lands rather than blocking it, is available as a per-tenant opt-in from the dashboard; opting in takes that tenant off the synchronous evaluator only where the platform operator has enabled the async consumer at platform level, and the synchronous evaluator stays active otherwise. Tenants provisioned before this default keep the evaluator off until they self-serve it on. One narrow, specifically-scoped exception now exists: an operator-authored rule can match a downstream action against a syntactic, time-windowed regex pattern over an already-audited event's captured text (for example, a help request posted in a shared channel), which catches the specific undeclared-delegation shape this rule targets. This is pattern matching on a captured excerpt, not comprehension of what was said, and it does not generalise to coordination that leaves no matching text pattern in the audited fields. The operator constrains which shared services agents may touch, narrows the actions each agent is allowed at all, and reviews the per-agent audit chains for the activity that does surface.

Vortalis does not contain a superintelligent agent, and a runtime governance proxy is the wrong layer to claim it could. What the proxy provides stays meaningful against a far more capable agent: forensic evidence of every action, authority termination through scoped kill switches, and a cryptographically attested audit chain. The operator treats these as forensics and revocation, not containment, and keeps containment-grade controls at the model and infrastructure layers.

Vortalis does not catch an instruction hidden in an image or audio input that text-only inspection cannot see. That is a model-capability problem, and it is decided before the agent reaches the proxy boundary. An agent's declared input modes are published on its AGAP® agent card, but Vortalis does not inspect payloads for off-mode content, so the defence against the injection itself belongs at the model-provider layer, which the operator owns alongside the proxy.

Vortalis does not observe or prevent a compromise of the underlying model provider or its weights. The proxy's scope begins at the agent's first boundary call, downstream of where the model is served, so a tampered model or a breached provider is outside what a runtime governance proxy can see. An operator whose threat model includes the model provider adds controls at that boundary (separate signing keys, dedicated inference infrastructure, and attested model artefacts) alongside Vortalis, not within it.

Vortalis ships implemented adapter code, not stubs, across financial markets, healthcare, legal, and agentic commerce, each with a credential validator and the same pre-policy and audit-chain enforcement as every other adapter, but it does not ship the counterparty certification from the operator of the production network, and integration completeness against each live rail has not been independently verified end to end. Routing real settlement, clinical, trading, or legal traffic through one of these adapters requires the conformance, certification, and onboarding work specific to that network, which only the deployer can complete with the counterparty. The adapter handles the protocol; the operator completes the regulator-facing certification.

For the few milliseconds between credential decryption and the tokenisation step on the return path, the proxy holds cleartext credentials and cleartext upstream response data in process memory. This is structural, not accidental: the adapter needs real credentials to call the upstream API and real response data to apply the tokenisation rules. An operator whose threat model includes Vortalis itself runs the proxy inside confidential computing or enclave-based adapter execution on top of Vortalis, not within it. We state this boundary plainly rather than imply the data is never in the clear.

Every adapter receives a dict of parameters plus decrypted credentials, calls the upstream API, and returns a dict, with no database access, no side state, and no shared module-level mutable state. This is load-bearing for the claim that every action is decided by policy before it executes; stateful adapters would open paths where a decision is made before partial state from a prior call has settled, which would quietly undermine the very property the audit chain attests to. Use cases that need remember-this-for-next-time semantics are served by per-tenant configuration in the control plane, which the operator owns and which is itself governed, not by adapter-local state that no policy can see.

Updated 13 September 2026 (previously updated 3 September 2026). This item previously said per-destination egress stayed operator-enforced through host firewall rules until Render granted CAP_NET_ADMIN or we built a separate egress service. Neither happened, and neither was needed. Reading the path end to end showed the branch that dropped an egress-declaring adapter into the host network namespace could never be reached by any adapter an operator can upload: the validator blocks every network-capable import before the code is stored. We deleted that branch. On the namespace-confined path every sandboxed adapter now runs with no usable network at all, whatever its manifest declares, because it runs in a private network namespace with no usable network (loopback down), not because of any syscall-level filter; seccomp-bpf syscall filtering is not currently enforced on this path, since the committed filter documents are plain JSON, not the Kafel policy language the sandbox's nsjail invocation actually requires. An adapter that needs an outbound call describes it instead, and Vortalis makes that call itself against the destinations the adapter declared, checking the destination by exact host match and refusing internal, loopback, and cloud-metadata addresses. That check is a single control rather than layered defence, so we name it as one. It ships switched off; turning it on is a deliberate operator decision, not a default. The fallback path used when the namespace tooling is absent still enforces no network isolation, and the sandbox as a whole remains EXPERIMENTAL pending external security review.

Every admin-tier login path, password, SSO, and SAML, is wired to a multi-factor enforcement gate. A twelve-character password floor applies with no flag at all, and a breach-password check runs by default, independent of the MFA enforcement gate, though an operator can switch it off. New tenants enforce MFA for admin, tenant admin, and security analyst accounts from their first login, no grace window; viewer accounts are not gated. Tenants that existed before this change keep a 30-day enrolment window, shown as a countdown in their dashboard, before the same enforcement applies to them. A single legacy flag remains as a fallback, relevant only to the platform's own tenant-less bootstrap account, not to any customer tenant.

A controls matrix, a gap analysis against the relevant criteria, and first-draft policies exist so an audit or testing engagement can start quickly, but no such engagement has begun. An operator who needs a certificate or an attestation report today does not have one from Vortalis yet. We name that here rather than let a controls matrix stand in for a completed audit.