Products
Capabilities
One product family (one-shot, request-bound proofs) expressed for three audiences: cloud estates, AI agents, and live humans. The same primitives (compiled identity, envelopes, burn-before-validate) span all three.
Absolute claims assume the reference architecture. Provisional application filed.
One primitive, three surfaces
Humans prove through a Private Synonym Map ceremony (Pass+). Machines and agents prove with compiled twins and envelopes from Foundry. Every path still hits Gate’s ordered checks and Control’s ledger (authority expires at the end of each request).
Systems · APIs · workforce endpoints
Protect the estate without rewriting it
Put Gate in front of the routes that matter. PKI and mTLS stay for transport identity; ENI6MA replaces the reusable API keys and bearer tokens that authorize requests.
Features & functions
Gate form factors
Reverse proxy, SDK middleware, and roadmap sidecar, enforce the eight-stage order at the request boundary without changing upstream service code.
Per-endpoint policy
endpoint_id, policy_hash, method allow-list, TTL, and use count scoped to each protected route.
Durable nonce ledger
Control burns nonces before twin validation so identical envelopes cannot be spent twice, even after a validation reject.
Circuit lifecycle
Foundry mints per-identity binaries; Control activates and revokes with one registry state change.
Benefits
- A stolen secret is not a stolen capability (authority is request-bound and one-shot).
- Replay fails by design under the reference architecture.
- Revocation is one handle deactivation, not a rotation campaign across every workload.
- Coexists with certificates: keep the PKI hierarchy; fix the credentials that authorize requests.
Workforce API behind Gate
An existing REST service keeps its TLS certs and network path. Gate sits as reverse proxy on /api/orders. Each call carries a one-shot envelope bound to method, endpoint, body hash, and policy. A captured envelope cannot authorize a second call or a different route.
How ENI6MA sits on existing architecture
Leave load balancers, service mesh, and mTLS in place. Gate becomes the authorization plane for protected endpoints. Ambient API keys and long-lived bearer tokens come off those routes; certificates continue to prove channel identity. Migrate one endpoint at a time (see coexistence with PKI).
Mechanism claims
Authority expires at the end of each request.ShippingThe envelope binds method, endpoint_id, request hash, policy hash, tau, and nonce (one message, one use).Holds under the reference architecture
Replay is impossible by design.ShippingThe nonce is burned before validation in a durable ledger; it is spent even when validation later fails.Holds under the reference architecture
Revocation is one state change.ShippingDeactivating a circuit handle in the registry revokes the identity; there is no rotation campaign across every workload.Holds under the reference architecture
Immune to credential-vault breach.ValidatedNo vault of reusable secrets exists; identity is compiled into the circuit binary, not stored as a transferable credential.Holds under the reference architecture