CAIN-42 CAIN StudioRules, limits and glossary
Selling honestly is the strategy, not a constraint: the whole product is "check us, don't trust us", so one exaggeration costs the deal.
What you can say with confidence
- Every CODEGUARD decision has a signed receipt.
- Anyone can check it with the public key.
- One changed byte fails the check.
Never say this about Signed decision receipts
- "Proves what the agent did": it proves the decision.
- "Every CAIN product issues these".
- "Hardware-signed".
Rules for every product
- Never say certified, SOC 2, audited by a third party, compliant, guaranteed, unbreakable, bullet-proof or production-hardened. None of these is true today.
- Never invent customers, logos, revenue or user numbers. If asked: "we are an early company; I can show you the product working and the evidence, not a customer list."
- Never say we have patents. None has been granted.
- Numbers on these pages marked "our own check" were run by our team, not by an independent tester. Say so.
- A scanner or detector that finds nothing does not prove something is safe. Say "none of our checks fired", never "it is secure".
- Never quote a market statistic you cannot show the source for. Ask the prospect about their own situation instead.
- Never sell with regulation fear (for example "the EU AI Act fines you next month"). Sell "your buyer is asking for evidence".
- Only test a system the client owns or operates, and only after they confirm it in writing.
- Never send automatic or bulk messages. Every message is written or reviewed by a person and sent by a person.
- Nothing we sell is legal, tax, insurance or compliance advice.
- The company is FIRME AI CORPORATION, a three-person team. Never call it a one-person company.
- Any discount, custom contract, security questionnaire or legal question goes to the founder before you answer.
Known limits
Read the product's own limitations page before your first call. If a prospect asks about a limit, say it plainly; it builds trust.
Glossary
| Word | Meaning |
|---|---|
| AI agent | An AI model that is allowed to take actions with tools, not only to talk. |
| Blind set | A batch of attacks we wrote before changing the product and ran once, so we could not tune the product to it. |
| Byzantine / PBFT | A way for several servers to agree on a record even if one lies or breaks. CAIN-42 runs four, three must agree. |
| Deterministic | Gives the same answer to the same input every time; no AI model decides. |
| Ed25519 | A modern, widely used digital signature method. |
| Evidence bundle | A zip file with the report, the signed record and the verifier. |
| Fail-closed | If the check errors, times out or is unsure, the action is blocked. |
| False alarm | The product stopped something harmless. Too many and people switch it off. |
| Hash (SHA-256) | A fingerprint of a file. Change one byte and the fingerprint is completely different. |
| MCP (Model Context Protocol) | The common plug that connects agents to tools. An "MCP server" is a company's set of tools offered to agents. |
| Offline verifier | A small free program the customer runs on their own computer to check our evidence. It imports none of our code. |
| Pilot | A paid 30-day trial on the customer's own agents. |
| Prompt injection | Hidden instructions inside text the agent reads (a page, an email, a file, a tool description). |
| Signed record / receipt | A record sealed with a digital signature (Ed25519). Any change breaks the seal. |
| Tool | One thing an agent can do: run a command, send an email, call an API, read a file. |
Self-check quiz
Answer out loud before opening each answer. If you miss two or more, re-read pages 1-4.
1. What does a receipt prove?
What the gate decided.
2. Which product issues them today?
CODEGUARD.
3. How is it sold?
With the CODEGUARD pilot.
Back to the Signed decision receipts overview or the Top 25.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.