Not one product — a layered substrate. Each layer answers one question, and they bind together at startup so nothing moves without proof. Python is the operator surface; a hardened Rust kernel is the floor. All open source.
JIS — Identity · who
Ed25519 .aint identity. Cryptographic actor proof + FIR/A handshake — no shared secret, no central login. Revoke it yourself; rights flow from the binding, not a blocklist.
TIBET — Provenance · proof
Every action is a signed, chained token — who, what, why, context. Strip the chain and it stops verifying. Provenance is architectural, not a watermark you crop out.
Cortex — Permissions · allowed?
Trust-based gates, default-deny. Capability follows an earned trust tier, not an API-key scope. Every agent starts in sandbox and proves its way up.
AInternet — Network · reach
.aint naming (AINS) + agent messaging (I-Poll, plain HTTP — zero inference tokens) over an overlay/mux fabric. Run your own and federate it.
Continuity — Arrival & resume · survive
A resident arrival daemon plus sealed-state phantom resume — a session moves device-to-device, signed. Need to go back? The chain restores the state.
Trust-kernel — Runtime floor · enforce (Rust)
The hardened substrate. Binds identity + provenance at init and fails closed — a half-failure stops the pair. Like an OS kernel, but for trust: the reason an action is allowed at all.
Same AI stack. Same workloads. One has audit infrastructure. The other has hope.
Without Humotica
✗AI accesses customer data — no record of who asked or why
✗Agent escalates its own permissions — nobody notices
✗Tampered deployment passes all checks — AV engines fooled
✗Incident happens — weeks of forensics, no proof, no rollback
✗EU AI Act audit — "we log everything" but can't prove chain of custody
✗Rate limiting by IP — CGNAT makes it useless
With Humotica
✓Every data access = provenance token with identity, intent, and context
✓JIS validates intent per action — capability escalation blocked
✓Hash chain per byte — one tampered bit = airlock deny, zero output
✓Incident happens — full chain, instant forensics, rollback to verified state
✓EU AI Act audit — cryptographic proof of every decision, by design
✓Rate limiting by sovereign identity — CGNAT-proof
What keeps a CISO up at night
Five nightmares. Five protocols.
Not a checklist. A kill chain — for the attacker.
01
"My AI did something nobody asked for"
Rogue agent escalates its own permissions. Or an attacker redirects it via prompt injection. Either way — unauthorized action, your liability.
→
JISSNAFT Intent kills autonomy
Every action validated against declared intent. Payload doesn't match purpose? Dead before it reaches the model. Submit code ≠ publish article.
02
"Our data was suddenly outside"
Sensitive data leaks via output, system prompts get exposed, or RAG returns too much. One API call, 46.5M messages out the door.
→
TIBETJIS Every access is earned
Every data access = signed provenance token with identity and intent. No valid identity, no data. System prompts behind JIS-gated access.
03
"Something got in that we didn't check"
Tampered packages, poisoned dependencies, compromised model weights. 50 out of 51 antivirus engines missed it.
→
TBZFORGE One bit. Airlock deny.
Hash chain per byte. One tampered bit = zero output. Trust scoring on every dependency. The format IS the security.
04
"We can't prove what happened"
No audit trail, no chain of custody. Weeks of forensics. EU AI Act asks for proof — you have logs. Logs aren't proof.
→
TIBETRVP The chain is the proof
Cryptographic provenance chain. Every decision signed, every handoff chained. Instant forensics. Rollback to any verified state.
05
"Someone is abusing our system and we don't know who"
Resource abuse, denial of wallet, DDoS. Rate limiting by IP is broken — millions share one IP behind CGNAT. You're blocking the wrong people.
→
JIS Identity, not IP address
Sovereign identity per actor. CGNAT-proof. Not by IP — by who you actually are. Token-validated requests only.
Informed by the global security research community, including the OWASP Top 10 for LLM Applications. These five scenarios reflect the risks we hear most from CISOs and CTOs deploying AI in production.
The trust kernel
Not an audit tool. A trust kernel.
An audit tool scans after the fact. A trust kernel is the reason the action is allowed in the first place. Nothing moves without proof — like an OS kernel for trust.
Rogue agent prevention JIS
Every agent action requires validated intent + identity. No authorization, no action. Autonomous doesn't mean unsupervised.
See: Meta rogue agent (March 2026)
Model handoff integrity TIBET
When Agent A hands work to Agent B, the full provenance chain transfers. No token gaps. No blind trust between models.
Prompt injection blocking SNAFT
Declared intent vs. actual payload — if they don't match, the request dies before it reaches the model.
See: McKinsey Lilli breach (March 2026)
Inference audit trail TIBET
Every inference is a signed token: who asked, what model answered, what context was used. Cryptographic proof, not log files.
Multi-model orchestration TIBETJIS
Gemini, Claude, local models — every handoff signed. Trust scores per model. Capability escalation blocked at the identity layer.
Capability escalation blocking JIS
An agent asked to generate a report cannot publish an article. Intent is validated per action, not per session.
See: OpenClaw rogue agent (Feb 2026)
DDoS mitigation TIBET-NC
Token-validated requests only. Volumetric attacks without valid provenance tokens are dropped before they hit the application layer.
See: DigiD DDoS — 3x in 2026, hours of downtime
Session hijacking prevention JIS
Sessions are bound to identity + context. Logging in from the Netherlands while the session originates in Spain? Doesn't match. Denied.
See: Dutch police cookie session exploit
Social engineering resistance JISTIBET
Even with stolen credentials, every action must match the identity chain. Phished login + unusual action pattern = blocked.
See: Odido breach — 6.2M customers (Feb 2026)
CGNAT-proof identity JIS
Rate limiting by IP is broken — millions share the same IP behind CGNAT. JIS identifies by sovereign identity, not network address.
Tamper-evident archives TIBET
ZIP files that can't lie about their contents. Hash chain per byte — one flipped bit, airlock deny. The format IS the security.
See: Zombie ZIP CVE-2026-0866 — 50/51 AV fooled
Zero-trust data access TIBETJIS
Every data read is a provenance token. Who accessed what, when, why, with which intent. Not logging — enforcement.
Together they form a complete trust infrastructure from agent discovery through continuous verification down to cryptographic provenance.
What we build & audit
We build what we make auditable, and we make auditable what we build.
From model inference to orchestration — every layer, every handoff, every byte.
Provenance
AI actions & decisions
Every inference call, every response, every tool use. Four dimensions per token: content (ERIN), references (ERAAN), context (EROMHEEN), intent (ERACHTER). Immutable chain.
Identity
Who did what & why
Semantic identity that validates intent, not just credentials. Behavior-based trust scoring. Per-identity rate limiting that works behind CGNAT. Spoof-proof.
Process
Deployments, handoffs & pipelines
Five-layer process capture: machine state, dependencies, steps, results, verification. Fork tokens for multi-actor handoffs. Reproducible execution.
Infrastructure
Orchestration & transport
We audit through the orchestration layer — PBX trunking, AI-to-AI messaging, remote command execution. Self-built orchestration platforms, all with TIBET provenance.
Intervention
Triage, airlock & rescue
When something breaks, the audit trail becomes the investigation. tibet-triage for human-in-the-loop. tibet-flare for rescue. Every intervention is itself a token.
State
Snapshots, rollback & time travel
Cryptographic state snapshots at any point. Roll back to any verified state. Resume sealed AI sessions across devices. The audit trail is a time machine.
Protocols
Twelve Internet-Drafts. Five core protocols.
Each protocol answers one question. Together they form a complete trust infrastructure.
Regulation is converging on one question: can you stand behind the action?
The EU AI Act, DORA, NIS2, SR 26-2, the Cyber Resilience Act, ISO/IEC 42001 and NIST AI RMF point toward the same operating need: accountable execution, controlled third-party dependency, traceable AI use, resilient recovery, and evidence that survives failure. Humotica does not replace these regimes — it produces the runtime evidence they increasingly require.
EU AI Act · phased, not postponed
Enforcement and transparency obligations are already active (2 Aug 2026); high-risk obligations arrive 2 Dec 2027 (Annex III) and 2 Aug 2028 (product AI). Humotica provides runtime evidence for the controls institutions must evidence — identity, traceability, human posture, capability, and auditability of AI-assisted actions. Not a compliance claim.
SR 26-2 · the runtime gap
The Fed/OCC/FDIC replaced SR 11-7 with SR 26-2 (17 Apr 2026) and left generative and agentic AI to the institution's own governance. Humotica addresses that gap — not by judging the model, but by preserving who acted, under which mandate, on which substrate, with which evidence.
DORA · in force since Jan 2025
ICT and third-party risk, incident reporting, resilience testing. Humotica makes the action identity-bound and failure-preserving: it either completes, or the evidence survives.
NIS2 · operational cyber discipline
Risk analysis, incident handling, supply-chain security, cryptography, access control. Humotica turns that discipline into local evidence and an incident-reconstructable action history.
Cyber Resilience Act · BOM & lifecycle
Reporting from 11 Sep 2026, full application 11 Dec 2027. Humotica's BOM evidence layer supports the CRA posture: what the box is made of, how it was sealed, and whether runtime evidence links back to the shipped components.
ISO/IEC 42001 & NIST AI RMF
Humotica does not replace AI governance frameworks. It gives them runtime evidence — Govern, Map, Measure, Manage, backed by what actually happened.
Research & standards
Twelve IETF Internet-Drafts. Peer-reviewed on Zenodo.
Including the first self-validating academic paper — a paper that refuses to exist until your machine proves the math.
1,100+ endpoints (as of Aug 2026). One brain. This is what trust looks like under the hood.
0REST endpoints on a single brain
From honeypot traps to dead man's switch vaults. From SIP proxy to sovereign identity. All open source.
Verify our claims
Test the code, don't trust the slide.
Open, runnable interop conformance. Clone a kit, run it, watch it go green — then check it with your own implementation. The vectors are the contract. Apache-2.0. Bring your own verifier.
Something compromised? The airlock catches it. Need to go back? The chain restores your state. Rogue AI? Every action was already logged with who, what, and why. No new workflows. No friction. Seatbelts that don't cut into your neck.