THE MODEL, WITH CLAIM STATES.
What the platform does about who can see and do what, stated as Observed, Designed, Planned or Not claimed.
/CLAIM STATES
FOUR STATES, NO FIFTH.
Every statement on this page is in one of four states. Observed names the evidence it rests on; the other three say what it does not.
Seen working in the kernel, with evidence we can point to.
Specified and recorded; not yet shown running end to end.
Intended. Not designed to the point of being claimed.
We do not claim it. Do not read it into anything above.
Access that was granted once and never reviewed is access nobody remembers granting. A grant that expires and names its scope has to be renewed on purpose. Expiring is the difference between access you gave and access you forgot.
/ISOLATION
ONE CUSTOMER, ONE STACK.
Each customer's environment is its own stack, with its own keys, storage and runtime. Nothing is shared at runtime between customers.
Each customer runs as its own stack with its own keys, storage and runtime, and no runtime is shared between customers.
- /CUSTOMER · DESIGNEDits own keys and runtime
- /ANOTHER CUSTOMER · DESIGNEDno shared runtime
/GRANTS
ACCESS IS GRANTED, NOT ASSUMED.
Every request carries a signed proof tied to its exact body and a grant with an expiry and a scope, so a stolen token alone opens nothing. What we have not done is certify: no SOC 2 report, no ISO 27001 certificate, no CMMC status, no penetration test.
- /PROOF · OBSERVEDsigned, one node, once
- /SCOPE · OBSERVEDowner and facility
- /TIER · OBSERVEDset by the operation
- /CELL · OBSERVEDdecides, records a fact
A capability grant is not a bearer token: each request is signed, bound to one receiving node and the exact body, valid for a short window and accepted once.
evidence · repo-path · workspaces/internal/packages/pct/src/identity/RequestProof.tsevidence · repo-path · workspaces/internal/packages/pct/README.mdA grant authority that issues short-lived grants to a person after sign-in and revokes them when the person leaves.
/SCOPE
EACH PARTY SEES ITS OWN SLICE.
Scope is how a client's slice stays its own, and how a 3PL's operators can serve many clients without mixing them.
Every command carries an owner scope: a client user acts only on its own records, and an operator names the client it acts for.
evidence · repo-path · erp/ontology/CONTRACT-BATCH.mdevidence · record · agentstore:digios-erp.research/freeze-d-erp-149A scan of another client's pallet is refused without saying whose it is.
evidence · repo-path · wms/packages/wms-identity/README.mdEach facility is its own scope inside a customer environment, so a count, a hold or a stopped line at one site does not rewrite another site's stock.
evidence · repo-path · erp/ontology/CONTRACT-BATCH.mdevidence · repo-path · wms/packages/wms-place/README.md/AUDIT
EVERY CHANGE KEEPS ITS AUTHOR.
Writes are appended as facts naming who acted, under which scope and on whose behalf. A write-off is bound to the exact payload a person approved, so an auditor reads what was approved, not a summary of it.
Everything that happens to a cell is stored as a fact: an immutable recorded event with its own type, version, scope and retention class.
evidence · repo-path · erp/ontology/README.mdevidence · record · agentstore:digios-erp.research/freeze-d-erp-149Every recorded act keeps who did it, on whose behalf and under which scope.
evidence · repo-path · erp/ontology/CONTRACT-BATCH.mdevidence · record · agentstore:digios-erp.research/freeze-d-erp-149A command that depends on a recorded fact cites it by reference and digest, and the gateway checks the citation before the cell decides.
evidence · repo-path · erp/ontology/CONTRACT-BATCH.mdevidence · record · agentstore:digios-erp.research/freeze-d-erp-149WHAT DOES THE AUDIT TRAIL CONTAIN?
Each fact names the acting person or device, the scope it acted under and any person it acted for. Facts are appended, not edited; a correction is a new fact.
/APPROVAL TIERS
AGENTS DRAFT. PEOPLE APPROVE.
An agent can propose an adjustment or a cancellation, but it cannot dispatch one. A named person approves the exact payload, and the system runs it once under that person's scope.
| TIER | WHO MAY TAKE IT | EXAMPLES | STATE |
|---|---|---|---|
| DEVICE OR SYSTEM | A device session or a system reaction. | A handheld scan, an arrival, a move posted by policy. | OBSERVED |
| STAFF | A signed-in member of staff. | Opening an order, planning a task, drafting a request. | OBSERVED |
| PERSON ONLY | A person. An agent can only draft. | A write-off, an ownership transfer, publishing a rule set, raising a charge. | OBSERVED |
OPERATIONS BY TIER
DEVICE OR SYSTEM · 73
STAFF · 87
PERSON ONLY · 15
SOURCE · ERP CATALOG, D-ERP-149 FREEZE
CAN AN AI AGENT CHANGE OUR INVENTORY?
It can draft a change for gated actions. It cannot approve or dispatch one; a person with the right scope does, and the system records both names.
/OFFBOARDING
YOU KEEP EVERY RECORD.
At offboarding the tenant's key is destroyed and the stack removed, so what you exported is what remains.
Offboarding a customer destroys its encryption key first, then deletes its stack.
Every record we write for your operation is readable and exportable while you are with us and when you leave.
Key destruction that the customer triggers itself.
/NOT CLAIMED
WHAT WE DO NOT HOLD.
None of these is in place today, and nothing on this site should be read as implying one. Each is on this page so you do not have to look for the gap.
SOC 2 attestation.
ISO 27001 certification.
A third-party penetration test.
CMMC status, ITAR registration, or controlled unclassified information held on DigiOS.
An uptime or availability commitment.
Customers running DigiOS in production.
/REPORT
FOUND SOMETHING?
Write to hello@digimasonry.com. A person reads it.
DO YOU HAVE SOC 2 OR ISO 27001?
No. We hold neither, and we have not had a penetration test. This page lists what the design does and marks each item observed, designed or planned, so you can ask to see the evidence for any of them.
CAN I PUT CONTROLLED UNCLASSIFIED INFORMATION ON DIGIOS?
Not today. Contracts that flow CMMC requirements down to systems holding federal contract information or controlled unclassified information need an assessed environment, and we have no CMMC status. Send us the clause and we will tell you plainly whether we can be in scope.
SEND ONE CLAUSE.
Send the flow-down clauses from one prime contract and name the system that holds the data. We will answer clause by clause whether we can be in scope, and say no where the answer is no.