P-01
Fail closed, always
If Anubis cannot answer, cannot authenticate you, or cannot record the answer, the action does not happen. We would rather stop your agent than let one through unrecorded.
Autonomous software needs boundaries built for it.
Every previous generation of software waited for a person before it did anything consequential. That assumption is quietly baked into most of the access control running in production today - and agents have stopped honouring it.
The next perimeter is an agent with credentials.
For thirty years the question access control answered was can this identity reach this system? It is a good question and the industry got very good at answering it. It also assumes something that is no longer true: that between the grant and the consequential action, a human would be standing there.
An agent with a valid token can read an invoice or pay one. Same identity, same credential, same system. The permission model cannot tell the two apart, because it was never asked to. Everything interesting about the risk lives in the action, and the action is precisely what nothing is evaluating.
We think that gap becomes a distinct layer, the way authentication and authorization became distinct layers: a control point between what an agent intends and what it is permitted to do, that produces a recorded decision every time.
The hard part is not detecting that an action looks dangerous. It is being able to say, afterwards and under scrutiny, exactly why a specific action was permitted - which policy, which version, which rule, which reviewer. That is why Anubis is deterministic, why its vocabulary is three words, and why it refuses rather than guesses.
Four principles we will not trade away.
P-02
Deterministic decisions
No model participates in the authorization decision. A control that can be talked into a different answer is not a control, and one you cannot reproduce is not evidence.
P-03
Evidence over assurances
A decision is only as good as the record behind it. Evidence commits in the same transaction as the decision, or the decision does not happen.
P-04
Say what it does not do
Our documentation ships a limitations register, and this website names the boundary on every page that touches it. A limitation you can read is worth more than a capability you cannot verify.
Early, narrow, and working with real agents.
Anubis is in private access with a small group of security, platform and AI teams. We are not chasing a broad launch. We are working one real agent at a time, in real environments, learning exactly where a runtime decision earns its place and where it is overhead.
That means we will tell you when Anubis is not the right fit yet. It also means the teams we work with now have unusual influence over what gets built. If you are connecting agents to systems that matter, we would rather show you than pitch you.
Talk to us directly.
C-03
Pricing
There is no public pricing while Anubis is in private access. We will be straight with you about commercials in the first conversation.
Private access
See it against your own agent.
One agent, one action you would not want it taking unsupervised. That is the whole first session.