LiquidSilicon lets AI agents act on your business, and is engineered so a person stays in control of every consequential move. The Builder agent only ever writes proposals — it never applies a change on its own. When enabled, a Guardian scan reads each proposal for PII and prompt injection and can block critical and high-severity findings. You grant autonomy across five trust tiers and can revert to observe-only in one action. Every action is an append-only event you can replay, and each tenant’s data — including its AI keys — is walled off by forced Postgres row-level security. You bring your own model keys; they are encrypted under a dedicated key, and we never train on your data.
| Control | What it does | Guarantee |
|---|---|---|
| Human approval gateC-01 | The Builder writes proposals only. Nothing consequential ships without a human yes. | Dual control |
| Guardian proposal scanC-02 | When enabled, each proposal is scanned for PII, prompt injection, and out-of-scope actions; critical and high findings are blocked. | Critical + high blocked |
| Graduated autonomyC-03 | Five trust tiers you set. Revert to observe-only in one action; emergency freeze halts all agents. | Human override always |
| Append-only audit trailC-04 | Every action is an event, never an overwrite. Any past state is replayable, with full attribution. | Event-sourced core |
| Tenant isolationC-05 | Postgres row-level security, enabled and forced on every tenant table — including AI keys and spend. | Owner obeys policy too |
| Your keys, your dataC-06 | BYOK keys encrypted under a dedicated key with rotation. Your calls, your provider agreement. | We never train on it |
The Builder agent — the only agent that can author a change to your system — never applies anything directly. It emits an implementation plan for human review. This is a dual-control model: an agent can write a proposal, but a person is the one who ships it.
The Builder runs only against work a human has already approved to the ready stage, and its output is put through a sandbox validation step before it is even offered for review. Autonomous runs are off by default (BUILDER_AUTO_ENABLED=false).
ready.Detection is deterministic first — regex patterns, no AI in the loop — so PII and injection checks are reliable and repeatable. Only the deeper categories escalate to AI analysis.
| Layer | Detects | Action |
|---|---|---|
| PII exposure | SSN, email, phone, credit card, provider API keys (AWS / Stripe / GitHub / OpenAI / Anthropic), private-key blocks, connection strings, hard-coded passwords | Critical → block |
| Prompt injection | “Ignore previous instructions”, jailbreak / DAN patterns, safety-filter override attempts, role-reassignment | Flag + block |
| Permission boundary | An agent referencing entities or actions outside its declared scope, or proposing above its impact ceiling (Builder cannot self-classify critical) | Scope violation → block |
| Deeper categories | Compliance violations, security vulnerabilities, data exfiltration — escalated to AI analysis where regex alone is insufficient | Severity-scored |
Findings at critical or high severity block the source outright; lower-severity findings annotate but let the work continue. Each agent also carries a permission boundary that caps the entities it may touch and the maximum impact it may propose.
Autonomy is not a switch, it is a dial. Agents start at tier 0 (observe) and earn each higher tier by getting the last one right. You raise the dial one step at a time, and you own the direction of travel in both directions.
Human override is always available. Revert to observe-only in a single action — no redeploy, no downtime. An emergency freeze drops a tenant straight to tier 0 and halts every agent action at once, logging the demotion as it goes.
The core is append-only. An action is never an in-place edit — it is a new event on the log. That means any past state of your operation can be replayed and reconstructed, and nothing about how your software got here is a mystery.
Every Builder run — start, plan approved, plan blocked, completed, failed — is written to the events table with full attribution. The audit trail is not a bolt-on log; it is the same event stream the platform is built on.
Tenant separation is enforced in PostgreSQL itself with row-level security, so even a bug in application code cannot leak one tenant’s data to another. Every request sets app.current_tenant_id, and RLS policies filter every read and write against it.
RLS is not only enabled but forced — so the table owner role is subject to the same policies, closing the usual owner-bypass gap. It covers every tenant-scoped table, explicitly including the two most sensitive: tenant_ai_config (your encrypted AI keys) and ai_spend_ledger (your spend records).
LiquidSilicon is BYOK-first: you connect your own AI provider keys. Practically, that means your agent calls run under your agreement with the provider — your data flows on your terms, and we never train on tenant data.
The keys themselves are the crown jewels, so they get crown-jewel handling: encrypted at rest under a dedicated encryption key, held separately from the session secret, and versioned so the key material can be rotated without a disruptive migration.
BYOK_ENCRYPTION_KEY, separate from the app session secret.v2: prefix) so keys rotate without a flag-day migration.tenant_ai_config, itself under forced row-level security (C-05).We are candid about what is certified and what is not. Below is where each control we already ship maps to the frameworks that matter for agentic AI — stated as a mapping, not a claim of certification.
| Our control | Framework | Item it addresses | Status |
|---|---|---|---|
| Human approval gate + graduated trust tiers | NIST AI RMF | Human oversight / “Govern” + “Manage”; TRAIGA safe-harbor relevance | Designed to align |
| Human approval gate (no unsupervised action) | OWASP Agentic Top 10 | ASI01 — goal hijacking & excessive agency | Mitigation mapped |
| Guardian PII + prompt-injection scanning | OWASP Agentic Top 10 | Prompt injection / instruction manipulation | Mitigation mapped |
| Forced RLS + per-agent permission boundaries | OWASP Agentic Top 10 | ASI03 — privilege abuse & isolation failure | Mitigation mapped |
| Append-only event log with attribution | OWASP Agentic Top 10 | Chain-of-custody / traceability of agent actions | Mitigation mapped |
| Organizational controls & audit readiness | SOC 2 Type II | Security / availability / confidentiality criteria | In preparation |
Plainly stated: LiquidSilicon is not SOC 2 certified today — a SOC 2 Type II is in preparation. “Designed to align with NIST AI RMF” and “mitigation mapped to the OWASP Agentic Top 10” describe engineering intent and control coverage, not an audit, a certification, insurance, or a compliance attestation, and should not be read as any of those. For the EU AI Act, the platform is transparency-ready: interactions with an AI agent are disclosed as AI. We will update this page as formal attestations are completed.
We welcome reports from security researchers. Email us with details and steps to reproduce, and give us a reasonable window to remediate before any public disclosure. We will acknowledge your report and keep you updated.