COMPLIANCE. BUILT TO SURVIVE AN AUDIT.

A CISO signing off on an AI governance control needs a clean answer to two questions. Does the runtime phone home, and can an incident be contained without cutting customer traffic? systemprompt.io runs as a single binary against a local PostgreSQL. The health endpoint calls SELECT 1 on that database. There is no outbound dependency to any vendor service at startup or at steady state. Outbound traffic leaves the process only when an operator configures an upstream inference route (your own inference cluster or any /v1/messages-compatible upstream; Anthropic, OpenAI, Gemini, Bedrock, Vertex are secondary), and the route goes through whatever proxy or egress firewall the security team already controls.

Auth stays inside the perimeter too. Every session is an HS256 JWT. The binary signs tokens with a shared secret and verifies them locally in under a microsecond, so authentication does not require a round trip to an external identity provider. The signing key is checked at boot, and a secret under the configured minimum length is rejected before the process accepts requests. That maps to the ISO 27001 A.10 cryptography requirement that key material meet a documented minimum strength.

The control that matters for an audit of SOC 2 CC6.1 (logical access) is where the token is issued and validated. Both happen inside the customer's network, against configuration the customer owns. An auditor confirming "no external auth service in the data path" reads the health and auth references below and sees the decision happens in the same process that handles the request.

Every credential that enters a model prompt is one prompt injection away from being exfiltrated to a third party. A CISO reviewing an agentic AI deployment needs to confirm that API keys, database URLs, and OAuth tokens do not appear in prompts, completions, tool arguments, or stored conversation history. systemprompt.io handles this by injecting credentials on the MCP subprocess environment at spawn time, not in the request body the model builds its prompt from.

When an agent calls a tool, the system launches the tool as a separate subprocess and hands provider credentials (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, GITHUB_TOKEN) to it as environment variables. The model sees the tool name and the returned result. It does not see the credential that authenticated the downstream API call, because the secret lives in the subprocess address space and never lands on the request the model is built from.

Custom credentials follow the same path. The secrets layer flattens an arbitrary key-value map, and each value lands on the child environment under both its original and uppercased name. Plugin variables with the secret flag are filtered out of anything the model can read. For an auditor reviewing SOC 2 CC6.7 (data classification) or the HIPAA encryption addressable specification, the evidence is the list of destinations a secret can and cannot appear in, backed by the spawner reference and the plugin variable definition below.

The auditor question this section answers is simple. Show me every action this user took in a given window, and prove no action is missing. Every audit row in the logs table carries a user, a session, a trace, and an optional context and client identifier. Those fields are named columns in the schema, not parsed out of a free-text message, so the query is indexed and deterministic.

A lookup by request_id, task_id, or trace_id returns the original log event, the AI request, any MCP tool executions, and the per-step execution record in one response. A CISO or external auditor answering "what happened after this ticket was raised?" does not stitch together five log streams. They read one joined result set and replay the chain from identity to outcome. The underlying query service exposes the log search, tool execution listing, audit lookup, and level counts the admin dashboard and SIEM exporter use.

Retention is tiered by log level so debug chatter does not dominate the table compliance queries run against. Debug rows expire after one day, info after seven, warnings after thirty, errors after ninety, and the scheduler runs a vacuum after cleanup so the physical size of the table tracks policy. That maps to SOC 2 CC7.2 (system monitoring) and ISO 27001 A.12.4 (logging and monitoring). The retention period is a configurable policy, not an accident of disk space.

A compliance control a CISO can rely on has to enforce before the risky action runs, not flag it afterwards. Every tool invocation fires a pre-tool-use hook before the model-facing handler touches inference. A denying hook short-circuits the call, and the audit row records the denial with the same identity fields as any other action. Without this gate, a policy violation is a post-mortem instead of a control.

Hooks load as YAML at boot. Matcher patterns, hook category (system or custom), visibility scope, and an action that dispatches to a shell command, a prompt, or a sub-agent. The security team owns the hook file, ships policy changes on its own release cadence, and reviews them in the same code-review pipeline as any other change. Because policies are code under version control, an auditor asking "show me when this rule was introduced and who approved it" reads a git log, not a ticket trail.

Lifecycle events give policy attachment points across the agent runtime. Pre-tool-use, post-tool-use, post-tool-use-failure, session start, session end, user prompt submit, notification, stop, subagent start, and subagent stop. That covers the excessive-agency risk directly. The pre-tool-use variant blocks an action before it executes, and the subagent-start variant blocks a sub-agent from being created with an unsanctioned capability.

Role-based access control an auditor can trust has to enforce at two layers. A caller without the right role gets a typed denial, and a caller without the right role never sees the tool in the first place. systemprompt.io encodes role tiers as a single enum (admin, user, service, agent-to-agent, MCP, anonymous) with numeric hierarchy levels. A required tier either is or is not met. No fuzzy string match, no custom role sneaking past a whitelist because nobody added it.

A finance analyst and an engineering analyst sit in the same role tier, but their tool surface differs. The request context carries department scope, the caller's roles, and a session identifier alongside the tier. Tools the caller is not scoped to are absent from the manifest the caller loads. A finance agent does not see engineering's audit tools and cannot call them by URL, which closes the information-leak variant of access control that an external penetration test usually catches.

The permission check runs in middleware before any handler code executes, so a bypass attempt using a forged path or a stale token returns a typed denial rather than silently hitting application code. For an auditor scoring SOC 2 CC6.3 (role-based access), the artefact is the permission-tier enum and the middleware that loads it, both referenced below.

Every call enters through the API layer and is evaluated before reaching application code. Per-endpoint rate limits are sized to the workload. MCP tool traffic gets a higher base rate because real agent workflows batch, and inference gets a lower base rate because a tight inference loop is always a bug. Role multipliers scale the limit by tier so an admin script gets headroom that an anonymous caller does not, and so an unauthenticated runaway cannot saturate the backend.

The binary is compiled from a memory-safe systems language. The compiler rejects buffer overflows, use-after-free, double-free, data races, and null pointer dereferences at build time, not at runtime with a sanitizer. The memory-safety class of CVE that routinely appears on a CISO's supply-chain dashboard cannot ship in the artefact at all. An auditor reviewing OWASP A06 (vulnerable components) sees a build that fails before linking rather than a runtime mitigation that hopes to catch the bug in time.

The build is a single statically linked binary pinned by a cryptographic lockfile. The same source produces the same binary, so a later audit of a production artefact reproduces from a tagged commit without a floating dependency resolving to something new. A scanner detector compiled in blocks scanner probes (env-file sweeps, phpmyadmin fingerprints, cgi-bin walks) and named scanner tools at the edge of the request lifecycle, before any handler runs, so credential-exfiltration probes fail ahead of dispatch.

systemprompt.io's architecture does not certify an organisation. It provides technical controls an auditor maps to specific clauses in the frameworks the organisation is certified against. For a CISO presenting an AI governance layer to a SOC 2, ISO 27001, or HIPAA auditor, the evidence is a specific reference in this codebase paired with a specific clause in the framework.

SOC 2 Trust Services Criteria. The air-gap runtime supports CC6.1 (logical access controls) through the in-process token issuer and validator. Credentials off the prompt path support CC6.7 (data classification) through environment-variable injection that keeps keys out of the prompt. The replay chain supports CC7.2 (system monitoring) through the named-column log schema. RBAC supports CC6.3 (role-based access) through the permission-tier enum.

ISO 27001 Annex A. Secrets management supports A.10 (cryptography) through the HS256 signing-key minimum. RBAC and department scope support A.9 (access control policy) through the tier-plus-department claim structure. The replay chain supports A.12.4 (logging and monitoring) through the retention policy and query service. The retention policy itself addresses A.18 (compliance with legal requirements).

HIPAA Security Rule. The server-side credential injection path supports the encryption addressable specification. RBAC and department scope support the access control standard. The replay chain supports the audit controls standard. Each maps to a specific code reference an auditor reads directly.

OWASP Top 10 for Agentic Applications. The governance pipeline addresses excessive agency through pre-tool-use hook denial. RBAC with department scoping addresses privilege escalation through scope-filtered manifests. Scanner detection addresses credential leakage through boot-time validation and inline probe rejection. The replay chain addresses lack of traceability through the named-column log schema. Risks outside current scope (hallucination detection, retrieval-augmented generation poisoning) are documented in the OWASP implementation guide, so an auditor sees what the architecture covers and what it does not.