Trust

The boundary is the operating system, not a prompt.

Every run is inside the sandbox the operating system enforces, from a settings file the agent can read but not edit. Every inbound door is shut until you open it. Prompt injection is contained, not prevented. Nothing phones home: the one outbound check is a daily look for a new release, and it can be switched off.

The boundary is the operating system.Seatbelt on macOS; a low integrity level and a job object on Windows, or a container when Docker Desktop or Podman Desktop is installed. A machine that can do neither is refused workloads.

Every inbound door shut until opened.The A2A agent card and inbound door return 404 until switched on. MCP write tools need an app key. Metered model keys are never in a run until the API switch is on.

Contained, not prevented.A hostile document can still steer what a run writes. It cannot make the run spend, sign, publish, contact a person or reach a host you did not name, and the trace shows what it did, call by call.

Nothing phones home.Telemetry is local. The licence key is verified on your machine. The update check is one request for public release metadata a day, and it can be switched off.

The concerns, and what the product does about each

Designed against the list buyers actually keep.

The OWASP Top 10 for Agentic Applications 2026 and the questions a platform team asks. Each row names a mechanism in the repository and the test file that holds it to its word. The framework codes are our own mapping.

Concern	Plain claim	Mechanism	How you verify it
Goal hijack and prompt injection ASI01	Contained, not prevented. The run is inside the sandbox with the reserved acts out of reach, and the trace shows what it did, call by call.	The OS sandbox, `scripts/kernel/sandbox.py`, with `failIfUnavailable` set; the reserved acts, `scripts/kernel/human_acts.py`	`scripts/test_kernel.py`
Tool misuse and unexpected code execution ASI02, ASI05	Every agent runs from a settings file it can read but not edit. A machine that cannot hold a workload in a sandbox is refused workloads rather than given unsandboxed ones.	`scripts/kernel/sandbox.py`; the macOS and Windows boxes in `scripts/kernel/containment/`	`scripts/test_kernel.py`, `scripts/test_containment.py`, `scripts/test_containment_windows.py`
Identity and privilege abuse ASI03	A run on the seat proves which account it is spending before it starts. A metered key is never in a run's environment unless the Human's API switch is on, and the switch is off by default.	The billing-channel preflight, `assert_on_seat` in `scripts/kernel/preflight.py`; `api_enabled` false by default in `scripts/kernel/accounts.py`	`scripts/test_kernel.py`, `scripts/test_accounts.py`
Supply chain ASI04	An imported agent starts untrusted: read-only tools, no MCP servers, no schedule, no memory store. Each capability opens only as a person promotes it, one level at a time.	`scripts/kernel/importers/quarantine.py`	`scripts/test_imports.py`, `scripts/test_console_imports.py`
Memory and context poisoning ASI06	Every layer of instruction a run receives is a versioned file, shown in order in one sheet, with the history of every commit that changed it.	Instruction layers, `scripts/console/instructions.py`; rules, `scripts/console/rulesets.py`	`scripts/test_instructions.py`, `scripts/test_rules.py`
Insecure inter-agent communication ASI07	The A2A agent card and the A2A inbound door answer 404 until switched on from the Security screen. MCP write tools need a write app key. App keys are scoped and hashed at rest.	Signed cards, `scripts/kernel/agentcard.py`; app keys, `scripts/console/appkeys.py`; MCP, `scripts/console/mcp.py`	`scripts/test_security_posture.py`, `scripts/test_appkeys.py`, `scripts/test_cardsign.py`
Cascading failures ASI08	Kill switches at five scopes, written to the one halt file every run reads before it starts. A guardian reads every run as it happens and stops it on hard signals: a burst of denials, the same tool call repeated, a run near its turn cap with nothing delivered.	`HALT_PATH` in `scripts/guards.py`; `KILL_SCOPES` in `scripts/kernel/halts.py`; the guardian, `scripts/kernel/guardian.py`	`scripts/test_guards.py`, `scripts/test_console_killswitch.py`, `scripts/test_kernel.py`
Human-agent trust exploitation ASI09	The Desk shows each decision as a memo in the professional form of its domain, with the documents the stages wrote beside it. You decide on evidence, not on prose.	`scripts/console/desk.py`	`scripts/test_console_desk.py`, `scripts/test_desk_memo.py`
Rogue agents and sprawl ASI10	The registry is derived from the manifests, the signed cards, the workloads, the run ledger, the vault grants, the egress allowlist and the halt file; nothing on it is typed in twice. Anything that ran without a manifest is a shadow agent, and the board names it. Every quarter a person re-attests each agent.	`scripts/console/governance.py`; the tiers and attestation rules in `rules/governance.yaml`	`scripts/test_console_governance.py`
Data leakage	Default-deny egress with the sources named, and host groups no agent may add for itself. The console redacts anything credential-shaped from every document it publishes, and the hosted copy of the Desk is encrypted before it is uploaded. Telemetry stays on the machine.	`scripts/kernel/sandbox.py`, policed by `scripts/kernel/egress_policy.py`; the publishing scrub in `scripts/console/standby.py`; local telemetry, `scripts/console/telemetry.py`	`scripts/test_security_posture.py`, `scripts/test_console_standby.py`, `scripts/test_console_telemetry.py`
Cost runaway	A scheduled workload without a budget fails validation, every run carries a turn cap, and a run that reaches the seat's usage limit stops rather than waiting for it to reset.	`scripts/validate_manifests.py`; `max_turns` in `scripts/kernel/manifests.py`; `autoContinueAtUsageLimit` false in `scripts/kernel/sandbox.py`	`scripts/validate_manifests.py`, `scripts/test_kernel.py`
Auditability	Every console action is on the audit log with who did it, what it changed and what it was before; revert where reversing is possible. Every run leaves a record.	The audit log, `scripts/kernel/audit.py`; run records, `scripts/kernel/records.py`	`scripts/test_console.py`
Agents changing the rules they are judged by	The contract and the guard machinery are protected paths a workload cannot write. The two lists that name those paths are tested to agree, so a path cannot slip out of one and stay in the other.	`CONTRACT_PATHS` in `scripts/kernel/sandbox.py`	`test_the_two_protected_lists_agree` in `scripts/test_kernel.py`
Human acts	Fund, sign, submit, verify identity: a standing checklist an agent never attempts. What needs a person reaches the Desk as a memo and waits there.	`scripts/kernel/human_acts.py`	`scripts/test_business_layer.py`

macOS and Windows

What the OS holds is not identical on both.

On native Windows, reads and outbound connections are enforced by SoloINC's own file tools and egress gate rather than by Windows, because Windows offers no filesystem or socket boundary a program can put around itself without an administrator, and SoloINC never asks for an administrator password. A program the agent starts could read a file SoloINC would have refused it, or open a socket that goes around the gate.

Install Docker Desktop or Podman Desktop and SoloINC uses a container for scheduled agents automatically, a kernel boundary in all three directions. The security docs.

	macOS	Windows, native	Windows, with a container
Writes	kernel	kernel	kernel
Reads	kernel	SoloINC	kernel
Network	kernel	SoloINC	kernel
Process tree	kernel	kernel	kernel

EU AI Act Article 14, mapped

Human oversight, measure by measure.

Article 14 asks that a person be able to understand the system, interpret its output, override it and halt it, and that its logs are kept. Each of those words has a place in the product. This is our own mapping of the product onto those words, not an assessment, and nobody outside 8086 LLC has assessed it.

The risk tiers in rules/governance.yaml (minimal, limited, high, unacceptable) are each mapped to the EU AI Act's tier and to the NIST AI RMF functions the controls have to satisfy. The same file drives the Governance board and the evidence pack.

Article 14 measure	Where it lives
Understand	The instruction layers: every layer a run is told, in the order the model receives them, each with its history.
Interpret	The memo: every Desk item in the form its domain uses, with the documents the stages wrote and the trace.
Override	The Desk: approve, continue, send back with a question, reject, release a parked item with a direction.
Halt	The kill switches: agent, stage, pipeline, cell, everything, all written to the one halt file every run reads before it starts.
Logs	Per-call traces for thirty days; the audit log with before-values; run records.

What we do not claim

Said plainly, so nobody has to ask.

A platform team's checklist has boxes we cannot tick. These are the ones, and why.

No SOC 2, no ISO 42001, no third-party audit. 8086 LLC holds none and does not say otherwise. The tests in the repository are what stand behind this page.
No claim about encryption of data at rest. The state root is on your disk. Full-disk encryption is the buyer's choice and the buyer's act.
Prompt injection is contained, not prevented. A hostile document can still steer what a run writes. The sandbox, the reserved acts and the trace bound what that can cost.
Native Windows is the weaker box. Reads and network are held by SoloINC, not by Windows, until a container engine is installed. The table above says exactly where.
The installers are not yet code-signed. SmartScreen and Gatekeeper warn before the first launch.

Verify it yourself

The tests exist in the repository.

Every mechanism on this page is held by a test file under scripts/. They run in the ordinary test suite, and anyone with a checkout of the source can open any of them and read what it asserts. These are the files.

The threat model, with the residual risks stated, is docs/THREAT-MODEL.md in the same repository.

scripts/test_accounts.py
scripts/test_appkeys.py
scripts/test_business_layer.py
scripts/test_cardsign.py
scripts/test_console.py
scripts/test_console_desk.py
scripts/test_console_governance.py
scripts/test_console_imports.py
scripts/test_console_killswitch.py
scripts/test_console_standby.py
scripts/test_console_telemetry.py
scripts/test_containment.py
scripts/test_containment_windows.py
scripts/test_desk_memo.py
scripts/test_guards.py
scripts/test_imports.py
scripts/test_instructions.py
scripts/test_kernel.py
scripts/test_rules.py
scripts/test_security_posture.py
scripts/validate_manifests.py

Disclosure

Found something? Tell us.

Email security@soloinc.ai. Say what you found, how to reproduce it and what it exposes. A PGP key will be published with the first tagged release.

3Acknowledged within 3 business days.

10Assessed within 10 business days, with a severity and a plan.

→Fixed in the next release when confirmed. A critical issue ships as a patch release as soon as it is fixed, and the release notes say so.

0No bounty. We acknowledge reporters in the release notes if they want it. The full policy is in SECURITY.md in the repository.