Security architecture. Control, records, verification.

Mickai's SIOS security design combines customer-controlled infrastructure, operator-held keys, hardware attestation, agent controls and the signed Open Audit Record. An isolated workflow requires local models and supporting services; approved external connectors have a separate boundary. Confirm supported controls and event coverage for the proposed version, then test permissions, egress, failures and recovery. Architectural descriptions are not a security certification or proof of deployment behaviour.

Sentinel is designed to inspect untrusted inputs and gate destructive actions. MickaiClaw provides per-skill authority controls, with dry-run and human approval mechanisms to assess for high-impact actions. Confirm which controls, including any voice-biometric quorum, are supported and configured. Test malicious context, bypass attempts, revoked authority and unavailable policy services. No detector, firewall or sandbox alone proves that prompt injection or data disclosure is impossible.

The design places key custody and the Open Audit Record with the operator. Request the actual key-management design: signing and encryption keys, hardware protection, administrators, support access, backup, recovery, revocation and any escrow arrangements. Independent audit verification needs the records, a trusted public key and a compatible verifier. Confirm these arrangements in the proposed deployment rather than inferring them from hardware ownership.

The browser verifier checks hash linkage and ML-DSA-65 signatures on supplied records. Load the verifier and required key material before testing disconnected verification, and establish trust in the key separately. A successful check supports record integrity and association with a signing key. It does not prove that all events were recorded, that an answer was correct or that an action was appropriate or completed as intended.