Organization-scoped authority
Governed requests, policy profiles, inventory, and retained evidence are resolved inside the active organization boundary. A second organization does not inherit the first organization’s policy or operating data.
Security & compliance
Inspect the control boundary. Verify the evidence.
Sernixa governs agent actions before execution and records what the governed path can prove. This page separates controls built into the product from guarantees that depend on your deployment.
In the governed path
Controls that change what may execute.
These are product behaviors, not dashboard decoration. Their coverage is bounded by the integrations and runtimes actually routed through Sernixa.
Policy before dispatch
Allow, review, and reject decisions are evaluated before execution for calls that pass through the Sernixa CLI, SDKs, MCP gateway, or supported host integration.
Retained decision evidence
The Flight Recorder connects declared intent, policy outcome, approval state, provider usage, and supported runtime observations without presenting an agent message as proof.
Fail-closed readiness
Traffic readiness is separate from process health. Required schema, shared state, signing, and strict gateway assumptions surface as readiness failures instead of silently downgrading production controls.
Deployment truth
The limits are part of the security model.
Strong controls begin with an exact statement of where enforcement exists and where additional customer configuration is still required.
Runtime visibility covers only hosts where the Sernixa collector or a governed integration is installed and healthy.
A tool call made outside the Sernixa gateway, SDK, CLI, or supported host hook cannot be claimed as blocked by Sernixa.
Evidence bundles support customer diligence and audit workflows; they do not create a SOC 2, ISO 27001, NIST, GDPR, or HIPAA certification.
Signing and export guarantees depend on production signing configuration. Missing signing inputs remain visible and fail closed where required.
Buyer diligence
Test the exact workflow you plan to govern.
Map the agent, identity, policy, approval path, destination, evidence source, and recovery expectation. Then validate each claim against live readiness and retained records.