Who governs HALO? — Trust brief

One-page summary for boards, CISOs, and security architecture reviewers.

The question

If HALO autonomously remediates production systems, what stops it from going rogue? Who governs the governor?

Short answer

HALO governs agents; policy and humans govern HALO. No agent — including Truesec's own — executes without passing the Authority Engine. No engine decision bypasses the single execution gateway. Every consequential outcome is hash-chained in an append-only evidence record.

Layered controls

Layer	Control
Architecture	A single execution chokepoint: the Authority Engine decides, one governed gateway executes. Agents never call vendor APIs directly.
Action classification	Every capability carries an engineering-assigned action class (Safe / Constrained / Dangerous / Forbidden) — an objective property of blast radius and reversibility, never something a model or a slider can change.
Policy	Only bounded, reversible ("Safe"-class) actions are eligible for auto-execution, and only where your own autonomy policy explicitly allows it. Everything with real operational impact queues for human approval.
Autonomy matrix	Per-tenant, per-action-class, per-environment routing that you own and can preview before changing.
Kill switch	Emergency stop — per action, per tenant, or global — available at all times.
Tenant isolation	Every row, event, credential, and proof is scoped to your tenant; cross-tenant access is a structural impossibility, not a policy promise.
Human-in-the-loop	Disruptive action classes carry a heavy human-review default — they hold for human review even when your policy would otherwise allow automatic execution, until you explicitly widen that specific scope.
Audit	An append-only, tamper-evident evidence chain records proposals, decisions, approvals, executions, verifications, and rollbacks — and, uniquely, decisions HALO deliberately did not act on.

What agents cannot do

• Call vendor APIs directly — every write goes through the one governed gateway, with credentials brokered just-in-time from your own vault.
• Execute anything the Authority Engine denies or queues for approval.
• Cross a tenant boundary.
• Store secrets in agent state or in the evidence record.

What humans still own

• Expanding the autonomy matrix beyond its current scope.
• Approving actions classified as having real operational impact or higher.
• Deciding when a connected environment graduates from read-only monitoring to write-enabled operation.
• Deciding what, if anything, gets shared across tenants as abstracted defensive knowledge (never raw customer data).

Proof, not promises

Execution is not closure. A finding is only considered resolved once an independent verification step confirms the underlying risk actually changed — not merely that a command ran. That verification step, and the before/after evidence it produces, is what makes an auditor's question — "who approved this change, and why?" — a filtered evidence export instead of an afternoon of archaeology.

Related docs

• Truesec HALO documentation
• The Action Authority spine
• Public API overview