humming armsAI agents act with real tools, data and credentials. We build independent evidence and local control outside the run.
Commitments that govern what we build, how we verify it, and what we claim.
We record where decisions become actions: tools, networks, files, execution and credentials. The record must stand apart from the run it describes. An agent’s explanation can add context; its cooperation cannot be the foundation of the evidence.
Proviso. Coverage follows the instrumented boundaries of each deployment.
RatifiedWe keep policy evaluation and enforcement decisions local. No network call and no LLM call belongs on the critical path. Deterministic rules govern that path; any assisted triage runs asynchronously, away from the decision to allow or deny.
Proviso. Network controls must close routes that bypass the policy boundary.
RatifiedMissing, invalid or stale policy must never silently permit an action. High-risk egress and credential actions default fail-closed. Heartbeat loss has a defined response, and a failed automated stop triggers escalation.
Proviso. Other failure modes require explicit policy; incomplete policy can interrupt legitimate work.
RatifiedWe build on append-only, hash-chained records and sensor signatures. Signing keys stay outside the agent’s sandbox. The open-source verifier checks integrity and signatures without our servers, so inspection can be independent of the system under examination.
Proviso. Integrity alone proves neither complete capture nor a successful stop.
RatifiedWe design for redaction and tokenization at sensors, with action metadata and hashes as the default recording surface. Payload capture and HTTPS decryption are opt-in per policy. Customer-held keys, self-hosting and tenant isolation belong in the data boundary.
Proviso. Capture policy and deployment determine the actual data path.
RatifiedWe call a capability shipped only when the public changelog says so. Numerical claims are tagged fact, estimate or target. Facts need reproducible evidence, estimates state assumptions, and targets identify a goal.
Proviso. Report the verification actually run and what remains unproven.
RatifiedWe audit dependencies and licenses, keep lockfiles current, and review supply-chain changes. Our release architecture calls for immutable references, signing, provenance and reproducible builds. We never weaken a lint, test or security control to obtain a passing result.
Proviso. Origin evidence is not a promise of vulnerability-free software.
RatifiedWe separate the breaker from the server, with independent health checks and a heartbeat-based dead-man’s switch. Pause, termination, credential revocation, egress cut and quarantine belong to the containment design. Human involvement is explicit for high-impact actions.
Proviso. A stop command needs outcome evidence; unresolved failure must escalate.
RatifiedConnect actions to identity, context, policy and outcomes. Reconstruct what happened at the boundaries the deployment covers.
We record and control actions. Reasoning is optional context; hidden intent is not the basis of enforcement.
Pair local policy with an independent breaker. Check the stop’s outcome, and escalate when the control fails.
No LLM or network call on the enforcement hot path. No silent permits when policy is missing, invalid or stale.
Open formats and an open-source verifier keep independent inspection separate from commercial management. Evidence must stand on its own.
Checking record integrity must not require our servers. Verification remains a check on the record, with its limits explicit.
The inspection surface stays open. Commercial management has a clear boundary. Explore a component to see its role.
The independent trust surface
Observe actions at instrumented boundaries.
Queue records between collection and delivery.
Evaluate allow and deny rules locally.
Match actions against deterministic rules.
Bind action records to integrity and signatures.
Define the shared event and command schema.
Check integrity and signatures independently.
Instrument agent tool calls and their context.
The open-source verifier lets anyone check integrity and signatures without trusting our servers.
The management surface
Collect records and correlate across agents.
Carry out policy-driven containment commands.
Review evidence, policy and containment outcomes.
A release needs a decision trail and a verification boundary. We keep the record.
The company, the control boundary and the evidence.
Humming Arms is an AI agent security company building an independent flight recorder and circuit breaker. We work at the action layer: tools, networks, files, execution and credentials. The architecture connects recording, detection, policy-driven containment and reconstruction. We record what happened, bind it to policy and identity, and keep the authority to stop separate from the run. Coverage follows instrumentation and deployment.
Humming Arms uses an open-core model. Sensors, buffer, policy, detection, evidence, protocol, verifier and SDKs sit on the Apache-2.0 side. Server, breaker and console sit on the commercial side. The open-source verifier lets anyone check evidence integrity and signatures without trusting our servers. Open components stay independent of commercial implementation. The licensing boundary describes the architecture; the public changelog records released availability.
A record should not depend on the cooperation of the system it records. We separate evidence custody and enforcement from the controlled agent, and keep signing keys outside its sandbox. Agent reasoning can add context; action evidence is the foundation. The verifier checks integrity and signatures independently. Capture coverage, policy correctness and containment outcomes need their own checks. These are separate questions in an evaluation.
No LLM call belongs on the enforcement hot path. We use local policy evaluation and deterministic rules, without a network round trip for permission. Any assisted triage runs asynchronously, away from enforcement. Console availability cannot be the condition for an allow or deny decision. Configured policy defines authority, and missing, invalid or stale policy must never silently permit an action. Other failure behavior requires an explicit choice.
Our data architecture supports self-hosting and a hosted service, with customer-held keys. Sensor-side redaction and tokenization reduce collection before storage. Action metadata and hashes are the default; payload capture and HTTPS decryption are opt-in per policy. Capture policy and deployment determine the actual data path. In an evaluation, examine those settings, the recorder’s location, key custody and tenant boundaries together. There is no universal location to assume.
Book a demo around your agent environment, action boundaries and policy. Examine recording and verification alongside the breaker’s outcomes. Include unavailable policy, heartbeat loss, bypass paths and failed stops. Review the security model and ask which released capabilities apply to your deployment. A useful evaluation records what was exercised, the evidence behind each result and the remaining limits. Use the product, solutions and pricing pages to explore the scope.