Zero Trust Datazerotrustdata.io GitHub
ztd v1.2.0 Zero-trust execution layer Source available · BSL 1.1

Zero Trust Data

Verify, then execute.

We build ztd, a zero-trust execution layer for AI agents and the infrastructure they touch. AI systems propose actions; they never get direct control of real systems. The model can ask. The machine that owns the workload decides.

Watch it LIVE Buy Fleet License Pack Evaluate Free Read the Source
// Jump to your track: 01 · Platform Engineers (Free to Evaluate) 02 · CISOs & VPs (50-Host Seat Packs) 03 · AI Vendors (OEM Embed) 04 · Principal Architecture Sprints

// ztd is Zero Trust Data: typed intent, independent verification, governed execution, and local evidence.

01 / The problem

Agents that think, approve, act, and log in one process

Most AI agent stacks collapse four separate jobs into a single process. That is a dangerous mix. ztd pulls them apart so the thing that reasons is never the thing that authorizes or executes.

Typical agent stack

Reasoning
Authorization
Execution
Audit

→ one process, one trust boundary. Whatever the model decides is what runs, and the record of it lives in the same place.

With ztd

  • Modelproposes typed intent
  • Gatewaygoverns: policy, consensus, human approval
  • Operatorverifies again and executes locally
  • Evidencerecorded at the execution boundary

This is not a sandbox. It is a governance boundary.

02 / How ztd works

A control plane for AI-driven operations

A client or agent submits a typed intent. The Gateway validates policy, applies human or quorum approvals when needed, and sends the action over an outbound-only connection to a local Operator. The Operator verifies the request on its own, executes only the approved action, and writes its own signed evidence.

Ingress

AI client

MCP, A2A, governed HTTP dispatch, direct envelope, or CLI.

expresses intent
Policy Decision Point

Governance Gateway

Authenticates over mTLS, builds a canonical GovernanceEnvelope, runs L1–L3, binds it to one Operator session.

ztd gw start
Policy Execution Point

Governed Operator

No inbound listeners. Pulls from its session channel, re-verifies everything in L4, executes in L5.

ztd operator start
Evidence

Signed receipts

EXECUTING and COMPLETED/FAILED receipts, plus a hash-chained commitment ledger on the host.

local-first audit

Gateway decides, never executes on your hosts

The Gateway admits transactions, manages PKI, and coordinates deliberation. It publishes each envelope to one exact session channel. There is no broadcast.

Operators verify for themselves

Each Operator recomputes the transaction hash, checks the replay nonce, expiry, and state root, and re-runs doctrine locally. It doesn't take the Gateway's word for it.

Receipts you can check

The Actuator signs a receipt before and after every action and appends to a hash-chained ledger. The host's local evidence is authoritative; Gateway copies are only mirrors.

Humans approve mutations

Under human-approval postures, mutating actions suspend until someone approves with a WebAuthn passkey or the enrolled CLI certificate (ztd auth approve --cli). Read-only actions don't need that step.

Quorum, signed

L2 Consensus requires K-of-N Ed25519 signatures from enrolled member keys over the transaction hash and decision.

Doctrine, always on

L1 Doctrine screens every envelope for forbidden patterns and ATT&CK-style heuristics in every posture, on the Gateway and again on the Operator.

03 / The interlock

Five layers between intent and execution

Every operation on a governed path crosses the same five-layer pipeline. A rule violation, or a proof the posture requires but the transaction lacks, rejects it.

L1

Doctrine

Forbidden-pattern matching, MITRE ATT&CK heuristics, and command safety analysis for things like reverse shells, privilege escalation, destructive disk operations, and credential theft.

OwnerGateway + Operator
L2

Consensus

K-of-N multi-signature Ed25519 authorization from enrolled member keys, each signing the transaction hash and its decision.

OwnerGateway + Operator
L3

Notary

Human authorization for mutations: the transaction suspends until a person approves it with a WebAuthn passkey or, via ztd auth approve --cli, the enrolled CLI certificate. An outbound Operator re-verifies the recorded approval and its Ed25519 signature over the transaction hash.

OwnerGateway + Operator
L4

Warden

Pre-dispatch gate on the target host: durable nonce reservation, expiry, typed payload decode, local doctrine, hash recomputation, state Merkle root, and posture-required proofs.

OwnerExecuting Operator
L5

Actuator

The single execution boundary. Signs an EXECUTING receipt, appends a signed commitment, mints a short-lived capability bound to the transaction hash, runs the typed handler, dissolves the capability, and signs the final receipt.

OwnerExecuting Operator
Governance postures · fixed at Gateway startup
PostureL1L2L3
doctrineenforcedauditedaudited
consensusenforcedenforcedaudited
ratifyenforcedauditedmutations
notaryenforcedenforcedmutations

Fail closed under every posture

  • L1 doctrine violation
  • transaction hash ≠ envelope id ≠ recomputed hash
  • replayed nonce
  • expired transaction
  • state Merkle root mismatch
  • invalid action type or undecodable payload

04 / Design lineage

An old idea, pointed at AI

The 1972 reference monitor said every access should pass a mediator that is always invoked, tamper resistant, and small enough to verify. Replace subjects and objects with agents and actions, and you get the shape ztd is built around.

// 01

Always invoked

every governed path → five layers

Every operation entering a governed path goes through L1–L5, and the L5 Actuator is the only place execution happens. Operators take work from one session channel and expose nothing inbound.

// 02

Tamper evident

signed receipts · hash-chained ledger

Receipts are signed at the execution site, commitments chain together in a local ledger, nonces are reserved durably to stop replays, and sensitive results are encrypted at rest with AES-256-GCM.

// 03

Verifiable

independent re-check · public source

The executing Operator recomputes hashes and re-checks proofs without trusting the Gateway. The code is published and the documented invariants carry stable IDs, so you can audit claims against the source.

05 / Zero trust, all the way down

Identity on every hop

Transport
TLS 1.3 + mutual TLSRequired on protected routes and pub/sub channels.
Workload identity
SPIFFE URIsOperators, CLIs, apps, and users each have their own identity.
Certificates
ECDSA P-256 · 7-day leavesSeparate intermediates; revocation checked per request.
Topology
Outbound-only OperatorsNo inbound management ports into target environments.
Signatures
Ed25519Consensus votes and approval proofs over the transaction hash.
At rest
AES-256-GCM vaultThree-tier keys: master key, HKDF-derived KEK, wrapped DEK.
Human auth
WebAuthn passkeys, CLI certificatesPasskeys for the console; the enrolled CLI certificate for ztd auth approve --cli.
Revocation
Immediate cut-offRevoking an enrollment adds it to the CRL and drops live sockets.

06 / Local-first, air-gap ready

Your hosts keep the truth

Under ztd's Local-First Audit Architecture, the host where an action runs is the authoritative record of what happened there.

  • One static Go binary. The same ztd binary runs as the Gateway and as each Operator.
  • Sovereign audit. Each runtime owns its SQLite audit database, vault, and state root.
  • Air-gapped deployment guide. Stage native binaries, or source builds with vendored dependencies, for offline transfer.
  • Bring your own models. An Inference Operator can serve local models through Ollama, so inference can stay inside your network.

Ways in · all governed

POST /mcpModel Context Protocol over HTTP, or stdio via ztd mcp stdio POST /api/v1/a2a/callAgent-to-agent skill calls POST /api/v1/operators/commandsGoverned HTTP dispatch for enrolled apps POST /api/v1/operators/intentsPlain-language intent; the Gateway Tribunal authors typed run_shell_command arguments that pass through MCP_CALL governance POST /api/v1/governance/envelopesPre-built envelopes; missing proofs are never synthesized ztd operator runCLI dispatch to bound Operators
Claude CodeCodexGemini CLIGooseDevin CLI

32 typed native tools in the reference binary: database triage, logs, processes, containers, filesystem, network and TLS, Git, cloud/Kubernetes inspection, denylist-screened shell commands, Operator deployment, and audit receipt queries.

07 / Quick start

First governed action in one command

Install the signed ztd binary, start a Gateway, sign in, and run a first governed action. Safe to rerun. Evaluation and other non-production use are free under BSL 1.1. Production use needs a commercial license plan below.

No root, no admin, no toolchain. Checksums verified before install. Binaries and Sigstore bundles: Releases.

./ztd tuiWatch live governance envelopes
./ztd login webOpen the console
# install, start a Gateway, sign in, run a first governed action
$ curl -fsSL https://zerotrustdata.io/start.sh | sh
# binary only: curl -fsSL https://zerotrustdata.io/ztd.sh | sh

08 / Pricing

Commercial Fleet Packs for Production Use

Your engineers are already connecting Claude Code, MCP servers, and autonomous agents to internal systems. Lock in production licensing on a corporate card today and receive a License Certificate for Finance and your auditors within one business day. Roll out the Operators at your own pace. Every plan runs the same audited binary, so you can verify every claim before you buy.

// DevSecOps & Lab Teams

Compliance CLI Pack

For engineering teams taking the source-available binary to production with auditor-ready cryptographic evidence.

$99 / month · per cluster
  • Commercial production rights for up to 10 enrolled Operators
  • Signed compliance report bundles: JSON, OSCAL, HTML & CSV evidence mapped to NIST SP 800-53 and FedRAMP 20x KSIs, verifiable offline
  • L1 Doctrine packs: MITRE ATT&CK detectors, gitleaks credential-egress rules & OWASP CRS
  • License Certificate emailed within one business day of checkout
Activate CLI Pack → Corporate card ready · Cancel anytime in 1 click
Most Popular · Corporate Card Ready
// Mid-Market & Series A–C Security

50-Host Fleet Pack

Lock in production licensing today and deploy across 50 hosts at your own pace.

$1,499 / year · (~$2.50 / host / mo)
  • Commercial production license for up to 50 Governed Operators & Gateways
  • License Certificate for Finance, procurement & auditors, plus signed compliance report bundles your auditors can verify offline
  • 12-Month Rollout Window: license now, enroll hosts over the year
  • Full L2 Quorum & L3 WebAuthn Passkey mutation gates
  • Direct async technical support from the Principal Architect
Buy 50-Host Pack ($1,499) → Fits within most corporate-card limits
// Enterprise & Air-Gapped Enclaves

250-Host Sovereign Pack

Full-scale deployment licensing for regulated infrastructure, hybrid cloud, and disconnected / DDIL environments.

$3,999 / year · 250 Operators
  • Everything in the 50-Host Pack scaled to 250 hosts and unlimited Gateways
  • Air-Gapped & Offline Deployment: Sigstore-signed static binaries + vendored source builds, with guided offline transfer
  • Custom L1 Doctrine Rules: tailored denylists for your internal SAN/NAS, Kubernetes & DB topologies
  • Async Architecture Topology Review included prior to production rollout
Buy 250-Host Pack ($3,999) → Stripe invoice at checkout · License Certificate within 1 business day
// Zero-Sales-Call Procurement Guarantee: Built by a Principal Engineer, not a sales floor. Purchase any Fleet Pack directly on a corporate card under our commercial terms, or email technical questions for a written response within one business day.
Request PO / Invoice via Email

09 / OEM license

Embed ztd Inside Your Commercial Product

Don't burn 9 months of engineering runway building SPIFFE PKI, mTLS session routing, WebAuthn passkey step-up, and hash-chained local SQLite ledgers from scratch. Exempt your product from BSL 1.1 restrictions and ship our static Go governance engine inside your SaaS, appliance, or federal deliverable.

  • Full BSL 1.1 Commercial Exemption: bundle ztd inside proprietary closed-source products and managed services
  • White-Label & OEM Redistribution: ship the Gateway and Operator binaries directly to your end customers
  • Protobuf Contracts & Go/TypeScript Bindings: wire your custom agent orchestrator directly into L1–L5 envelopes
Commercial OEM License
$2,950
Per Year · Unlimited Redistribution
License for OEM Embedding → Read the OEM agreement before checkout · Sent for signature after payment

10 / Architecture sprints

Hire the Principal Architect Behind the Engine

ztd and OpenDevOps.ai were built by Danny Barbour—a 30-year Principal Infrastructure, Storage & SRE Architect who built Igneous SRE 0→1 through its Rubrik acquisition and IPO (NYSE: RBRK), commanded Fortune 500 storage outage bridges at Quantum, and commissioned U.S. Navy warship IT from bare steel. Skip the 6-month executive search and book a fixed-price technical sprint.

// 5-Day Fixed Scope

Architecture & Red-Team Diagnostic

A brutal, senior-level technical audit of your AI agent boundary, Kubernetes/cloud platform, or petabyte storage pipeline.

$2,500 Flat Fee · 5 Business Days
  • Deep-dive inspection of your MCP/agent tool paths, IAM/PKI boundaries, or NAS/S3 data pipelines
  • Failure-mode & corruption analysis: identifying silent data risks, retry storms, and privilege bypasses
  • Deliverable: comprehensive written remediation architecture + recorded 30-minute video technical walkthrough
  • 100% Asynchronous option: zero meetings required unless you want a live Q&A review
Book 5-Day Diagnostic → Corporate card or invoice · Kickoff within 2 business days
Turnkey Implementation
// 2-Week Forward-Deployed Sprint

0-to-1 Governance or SRE Buildout

Drop a Principal Forward-Deployed Architect directly into your repo and cloud environment to wire and ship the solution.

$7,500 Flat Fee · 10 Business Days
  • Turnkey deployment of ztd L1–L5 governance OR autonomous SRE remediation on AWS, GCP, Kubernetes, or on-prem
  • Custom policy & pipeline integration: SPIFFE/mTLS, WebAuthn approvals, Terraform IaC, and Grafana SLO telemetry
  • Petabyte Storage & Backup Rescue: fixing bottlenecked NFS/SMB/S3 ingest or enterprise data-protection workflows
  • Full handoff package: production code, runbooks, and recorded training for your internal engineers
Reserve 2-Week Sprint → Available remotely or on-site (U.S. & EU work authorized)
// Ongoing Tier-4 Escalation

Principal Architect Retainer

On-demand access to a 30-year Principal SRE, Storage & Security Architect when your team hits a wall in production.

$3,500 / month · Cancel Anytime
  • Tier-4 Escalation Backstop: drop me into your hardest unsolved storage, Kubernetes, or security architecture fires
  • Async Architecture Reviews: weekly PR, RFC, and design-doc teardowns before your team commits to expensive mistakes
  • 0-to-1 Service & Support Design: building the escalation workflows, SLOs, and customer reliability model that scale to IPO
  • Includes a 50-Host ztd Fleet Pack active for the duration of your retainer
Activate Monthly Retainer → No long-term lock-in · Direct Slack/Email channel

11 / Track record

Why serious infrastructure teams trust Lateralus Labs

ztd wasn't built by prompt engineers guessing how production works. It was architected from the ground up in static Go by a Principal SRE and Storage Architect who has commissioned warship IT from bare steel, operated Nike's global backup infrastructure for 15 years, and scaled multi-petabyte SaaS reliability from 0-to-1 through acquisition and public IPO.

View Fleet License Packs Read Technical Docs
  • Verify it yourselfRun ./ztd eval conformance run, the governance conformance suite, to check every L1–L5 claim locally. It needs no model.
  • Air-Gap & Edge NativeSingle static Go binary with local SQLite ledger, AES-256-GCM vault, and zero inbound ports on managed hosts.
  • U.S. & EU Deployment ReadyLed by a U.S. Navy Veteran and Dual U.S./German Citizen available for remote async architecture or forward-deployed engagements across North America and Europe.

// end of transmission

Let the model ask.
Let the machine decide.

Clone the repo to test locally, lock in a 50-Host Fleet Pack on a corporate card, or book a fixed-price Principal Architecture Sprint. Email Danny directly.

Buy Fleet License Pack Book Architecture Sprint github.com/zerotrustdata/ztd

12 / Contact

No SDRs. No discovery calls. Just engineering.

Send a quick email with what you're building, which license pack you need, or what production fire you need fixed. You'll get a direct written response from Danny Barbour within one business day.

danny@zerotrustdata.io