Trust Center
Security
Kenshiki Labs security posture: the platform itself is built around evidence and replayability. Tenant isolation, deterministic logs, signed Claim Ledger entries, and replayable decision paths mean security claims can be examined rather than trusted. Production security commitments are defined in the governing commercial agreement specific to each deployment tier (Workshop, Refinery, Clean Room) — Clean Room provides the strongest attestation guarantees including TPM-anchored hardware attestation.
System architecture
Security starts with clear trust boundaries. Kenshiki Labs separates application surfaces, inference pathways, and source authority so governance decisions are not hidden inside a single opaque runtime.
- Explicit trust demarcation between app, model, and evidence layers
- Deployment patterns that support VPC and isolated execution environments
- Policy-aware control surfaces instead of best-effort post hoc monitoring
Access and authorization
Kenshiki Labs uses policy and relationship-aware control patterns to ensure access is evaluated at the moment claims are retrieved, transformed, or emitted.
- Least-privilege access evaluation
- Role and relationship boundaries on sensitive data paths
- Operator-visible enforcement outcomes when authority is missing
Evidence and forensics
Security claims are only useful if they can be examined later. Kenshiki Labs emphasizes deterministic logs, evidence chains, and replayable decision paths so incidents can be reconstructed without guesswork.