CAIN-42 CAIN StudioRules, limits and glossary
Selling honestly is the strategy, not a constraint: the whole product is "check us, don't trust us", so one exaggeration costs the deal.
What you can say with confidence
- Records are confirmed by four servers in four regions; at least three must agree.
- Only a fingerprint is sent; the content stays with the client.
- Receipts verify offline with a checker that has no CAIN code, against keys the client pins.
- A changed record, vote or cluster name fails verification.
Never say this about Quorum-QaaS (4-region PBFT)
- "Independent validators": all four are operated by us today, on one cloud provider.
- "Certified timestamp" or "legally binding": the time is the gateway's word.
- "Real-time": it takes seconds, not milliseconds. And never promise an SLA or uptime.
Rules for every product
- Never say certified, SOC 2, audited by a third party, compliant, guaranteed, unbreakable, bullet-proof or production-hardened. None of these is true today.
- Never invent customers, logos, revenue or user numbers. If asked: "we are an early company; I can show you the product working and the evidence, not a customer list."
- Never say we have patents. None has been granted.
- Numbers on these pages marked "our own check" were run by our team, not by an independent tester. Say so.
- A scanner or detector that finds nothing does not prove something is safe. Say "none of our checks fired", never "it is secure".
- Never quote a market statistic you cannot show the source for. Ask the prospect about their own situation instead.
- Never sell with regulation fear (for example "the EU AI Act fines you next month"). Sell "your buyer is asking for evidence".
- Only test a system the client owns or operates, and only after they confirm it in writing.
- Never send automatic or bulk messages. Every message is written or reviewed by a person and sent by a person.
- Nothing we sell is legal, tax, insurance or compliance advice.
- The company is FIRME AI CORPORATION, a three-person team. Never call it a one-person company.
- Any discount, custom contract, security questionnaire or legal question goes to the founder before you answer.
Known limits
Read the product's own limitations page before your first call. If a prospect asks about a limit, say it plainly; it builds trust.
Glossary
| Word | Meaning |
|---|---|
| AI agent | An AI model that is allowed to take actions with tools, not only to talk. |
| Blind set | A batch of attacks we wrote before changing the product and ran once, so we could not tune the product to it. |
| Byzantine / PBFT | A way for several servers to agree on a record even if one lies or breaks. CAIN-42 runs four, three must agree. |
| Deterministic | Gives the same answer to the same input every time; no AI model decides. |
| Evidence bundle | A zip file with the report, the signed record and the verifier. |
| Fail-closed | If the check errors, times out or is unsure, the action is blocked. |
| False alarm | The product stopped something harmless. Too many and people switch it off. |
| Hash (SHA-256) | A fingerprint of a file. Change one byte and the fingerprint is completely different. |
| MCP (Model Context Protocol) | The common plug that connects agents to tools. An "MCP server" is a company's set of tools offered to agents. |
| Notarize | Get a record confirmed and signed so it cannot be changed unnoticed. |
| Offline verifier | A small free program the customer runs on their own computer to check our evidence. It imports none of our code. |
| Pilot | A paid 30-day trial on the customer's own agents. |
| Pinned key | The cluster's public key the client saves in advance, so a fake cluster cannot pass. |
| Prompt injection | Hidden instructions inside text the agent reads (a page, an email, a file, a tool description). |
| Quorum | The minimum number of servers that must agree: 3 of 4. |
| Signed record / receipt | A record sealed with a digital signature (Ed25519). Any change breaks the seal. |
| Tool | One thing an agent can do: run a command, send an email, call an API, read a file. |
Self-check quiz
Answer out loud before opening each answer. If you miss two or more, re-read pages 1-4.
1. Does the client send us their file?
No, only its SHA-256 fingerprint.
2. How many of the four servers must agree?
Three.
3. A prospect says "you run all four, so why trust it?" What is the honest answer?
They are right that the operator is one company; it protects against a faulty server, not against us. Independent operators are the planned fix.
4. Can you quote a price?
No published price. Sell it inside the Safety Evidence Pack or pass to the founder.
5. Is it right for a real-time payment check?
No: about 2.6 seconds per receipt.
Back to the Quorum-QaaS (4-region PBFT) overview or the Top 25.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.