Why this exists
Make autonomous software accountable.
CAIN Trust Fabric is AI trust infrastructure for autonomous systems. This is what we are trying to do with it, and what we are willing to be held to.
Last reviewed 31 August 2026
AI systems have started to act. They spend money, change records, call tools and invoke other agents -- and most of the industry's safety work is still aimed at what a model says rather than what it does. CAIN Trust Fabric is aimed at what it does.
Our goal is that every consequential action an autonomous system takes passes through a boundary that is able to refuse it, and leaves behind a record that survives the incident review months later. Not a dashboard that describes what already happened -- a decision that happens first, and evidence that outlasts it.
What we hold ourselves to
Seven commitments, each written so you can test whether we are keeping it. A goal nobody can check is a slogan, so every one below names where to look.
1. No authorization, no execution
An action that has not been authorized does not reach the upstream service. Enforcement lives in the call path, not in a report written afterwards.
Check it yourself: POST /fabric/decisions and inspect the stage-by-stage verdict.
2. Unknown is never allowed
Every stage returns a typed verdict. A stage that could not run returns unavailable or not_configured -- never a silent allow. A control that fails open under load is a control that is absent exactly when it is needed.
Check it yourself: GET /fabric/status shows which stages are configured and live.
3. Every decision leaves evidence
Decisions are written to durable, tenant-scoped records with the stage verdicts that produced them, retrievable by id and signed so alteration is detectable. Reading evidence is itself recorded.
Check it yourself: GET /fabric/decisions/{id}/signature and GET /fabric/evidence-access.
4. The operator sets the limits, not the agent
Spend caps, call budgets and containment thresholds are held server-side and keyed on the tenant resolved from billing -- never on a value the caller sends. An agent cannot raise its own ceiling.
Check it yourself: Exceed a budget and observe the reservation refused, not merely logged.
5. Runtime-agnostic, with no framework lock-in
The boundary is a protocol -- HTTPS and MCP -- not a plugin. Anything that can make an HTTP request participates, and nothing has to be rewritten to adopt or to leave.
Check it yourself: The same endpoints and headers work from any client.
6. Deploy where your data has to live
The same architecture runs hosted by us or entirely inside your own network. Self-hosted means neither the traffic nor the evidence leaves your infrastructure, and no call has to reach us for a decision to be made.
Check it yourself: Compare the hosted and self-hosted deployments -- same domains, same verdicts.
7. Claim only what is implemented
Coverage gaps are published per trust domain, in the API, next to the capabilities that do work. Where a control is partial we say so rather than rounding up.
Check it yourself: GET /fabric/domains returns the gaps alongside the capabilities.
The one that constrains the rest: claim only what is implemented. It is why our trust domains publish their coverage gaps in the API next to their capabilities, and why we keep a public list of what this platform does not do yet.