Why us
An old architecture,applied to a new problem.
ENSIGS applies the reference monitor, the idea behind every trusted operating system since 1972, to AI agents.
The lineage
Three requirements,unchanged since 1972.
The Anderson report defined the reference monitor by three requirements, and every operating system you trust today was built on them. ENSIGS holds agents to the same standard.
- Requirement 01
Tamper-proof
Then: the monitor cannot be modified by the programs it governs. Now: the kernel sits in a hardware-attested boundary the agent cannot reach. - Requirement 02
Always invoked
Then: every access passes through the monitor. Now: every agent action passes through the kernel, along a single commit path with no way around it. - Requirement 03
Verifiable
Then: small enough to analyze completely. Now: default-deny membership checks, and evaluation that reproduces hash for hash across independent implementations.
The thesis
AI safety is anenforcement problem.
Most of the industry is betting on alignment, the hope that enough training will eventually make a model trustworthy enough to hold authority. We are betting on enforcement, which asks nothing of the model's character.
In ENSIGS the model proposes and the kernel decides, so the model never holds credentials, keys, or write paths at any point. Authority stays inside a custody chain that runs from kernel decision through hardware attestation to an append-only record.
That chain is what makes a serious class of agents deployable at all, the kind that finish consequential work without a human clicking approve at the end of every task.
The operator
Ten years ofenforcement work.
Instantial's founder spent a decade in trust and safety at Google, Meta, and Coinbase, enforcing policy against adversarial behavior at scale, under regulators, with real money on the line.
The lesson from that work is to assume adversarial input and fail closed, and ENSIGS carries it into architecture: patents filed, thirty-seven specifications under version control, and independent implementations that must agree with each other hash for hash.
Bring your hardestdeployment.
We will walk it through the custody chain with you, stage by stage, and you can decide whether the argument holds.