What Kronos secures

Six controls, one policy plane

What each control checks, the point at which it says no, and the evidence it leaves.

1. Supply chain

   Nothing serves unsigned

   Models, adapters, datasets and agent packages from any source earn their way to production.

   Model supply chain

   What it checks

   • Malware in every file before it is unpacked
   • Unsafe serialization such as pickle opcodes, and CVEs in the packaged runtime
   • An ML-BOM of weights, base model, datasets, licences and dependencies
   • A Sigstore signature, logged to a transparency log

   When it fails closed

   Unsigned, unscanned or undescribed artifacts stop at the promotion gate with a written reason. There is no partial promotion.

   What it records

   The ML-BOM, scan attestations, signature and the gate decision, attached to the registry entry.

2. Data

   Nothing embeds unchecked

   Documents, datasets and runtime uploads are settled before they reach a vector store or a fine-tuning run.

   Data ingestion

   What it checks

   • Malware, with active content detonated in a sandbox
   • Personal data, redacted, masked or rejected per tenant
   • Provenance: every chunk traced to a signed source
   • That the caller owns the collection it is writing to

   When it fails closed

   Unverified sources are held and infected files quarantined. Nothing writes to the index except through the gate.

   What it records

   PII actions per batch, the signed manifest, provenance per chunk and every vector-gate decision.

3. Runtime

   Every prompt is a policy decision

   People, applications and services calling a model all pass the same checks, in both directions.

   Prompts, APIs and agentsRed teaming

   What it checks

   • Tenant scope, model entitlement, data class and rate limits, before inspection
   • Injection and jailbreak classifiers on the way in
   • PII and secrets in responses on the way out
   • Continuous red teaming against live endpoints

   When it fails closed

   A call that fails authorization never reaches a GPU. A blocked prompt gets a safe refusal and a reason code.

   What it records

   Every verdict with its rule, scores and session, written before the connection closes.

4. Agents

   Agents act inside a fence

   An agent is where a model's output becomes an action, so it gets an identity, a sandbox and a policy.

   Prompts, APIs and agents

   What it checks

   • The agent package, its skills and MCP servers, before registration
   • Workload identity through SPIFFE and SPIRE, with mutual TLS
   • Every tool, model and data source against the agent's policy
   • Network egress, denied unless allowed

   When it fails closed

   A benign prompt still can't make an agent call a tool outside its allow-list. Containment sits below the classifier.

   What it records

   A trace of every tool call, inference call and access decision, linked to the agent's identity.

5. Cryptography

   Signatures that outlive the attack

   Weights and records stolen today are worth breaking years from now.

   Security fabric

   What it does

   • Signs artifacts and records with ML-DSA alongside the classical curves
   • Encrypts content with ML-KEM hybrids, under keys in your HSM or KMS
   • Encrypts embeddings and queries, so the vector store never holds plaintext

   Why it matters

   What you sign this year still verifies, and what you encrypt stays sealed, long after the machine that could break today's curves exists.

6. Audit

   A control you claim is a control you can show

   Every gate in every band writes to one record.

   Observability and auditAudit evidence

   What it keeps

   • An append-only, hash-chained record of every decision
   • Drift, policy violations and latency on the same stream
   • Retention set per tenant

   Where it goes

   Normalised to CEF and OCSF and forwarded to Splunk, Sentinel, QRadar or Elastic, with cases worked in your SOC.