TrustFabric

What is TrustFabric?

Clearception TrustFabric is a governance control plane for teams whose code is increasingly written, reviewed and shipped with AI agents. Policies are versioned bundles of deterministic rules, reviewed and approved by a second person before they take effect. Agents and CI/CD pipelines ask the authorization gateway before acting; it answers allow, deny, require approval or insufficient context, and missing context is never treated as permission. Data-sovereignty profiles decide which model providers, endpoints and regions a classification of data may reach. Approvals are bound to the exact action and context they were granted for, can be used once, and cannot be granted by the person who asked. Every decision is written to a hash-chained evidence log that can be verified and exported for an auditor. Uploaded policy documents are turned into suggested rules that a person must review; nothing is activated by AI. Each integration states honestly how strongly it can enforce: a pipeline gate fails the build, an agent runner you operate is enforced, and a developer-side hook is voluntary.

Problems it solves

• Stop an agent sending secrets or restricted data to an unapproved model provider
• Require a named human approval before a production deploy or data export
• Fail a release when required checks such as tests, secret scanning or an SBOM did not pass
• Keep data inside the regions a sovereignty profile allows
• Show an auditor which policy allowed or denied each action, with evidence that has not been altered
• Turn written policy documents into rules a reviewer can approve

Key capabilities

Deterministic Policy Engine

Rules, not inference, decide what is allowed to proceed — so a model can advise and never authorise.

Human Approval Gates

Anything with an outside consequence — a pitch sent, a product published, a campaign sent, a booking committed — waits for a person with the named permission.

Evidence Trail

Every figure carries the record it came from, so a reader can check the answer instead of trusting it.

Security Control Mapping

Analyse a design for security and reliability and map its controls to SOC 2, NIST, ISO 27001, HIPAA, PCI DSS and GDPR.

How it is built

Governance control plane

Organizations, projects, repositories and agents, with roles that separate policy authors, approvers and auditors.

Policy intelligence

Versioned policy bundles with diffs, second-person review, and rules suggested from uploaded documents for a person to accept.

Authorization gateway

One decision API for agents and pipelines: allow, deny, require approval or insufficient context, with the reason and the rule.

Agent and CI/CD governance

Register agents with an honest enforcement level, suspend or kill them, and gate pipeline stages on required checks.

Data sovereignty

Profiles per jurisdiction decide which providers, endpoints and regions each data classification may reach.

Compliance evidence

A per-organization hash chain of decisions and approvals that can be verified and exported as a package.

How it works

How the work is structured, and what each step's output rests on.

1. 1

   Write and approve policy

   Human-verified

   Author a bundle or start from the starter rules, then have a second person review and approve it.

2. 2

   Register what acts

   Source

   Add repositories, agents and pipelines, each with a workload token and its enforcement level.

3. 3

   Ask before acting

   Observed

   Agents and pipelines call the gateway; the policy engine evaluates the request against the active bundle.

4. 4

   Approve the exceptions

   Human-verified

   Actions that need a person wait for an approver who is not the requester; the approval works once, for that action only.

5. 5

   Prove it

   Source

   Verify the evidence chain and export the decisions, approvals and policy versions for review.

Example use cases

Each example has its own page you can read and share.

Ask TrustFabric

Illustrative examples. Results depend on your own data.

• “Which agent actions were denied this week, and by which rule?”
• “Can this agent send internal source code to this model provider?”
• “What approvals are waiting for me?”
• “Export the evidence for last quarter's production deploys.”

Security, governance and human control

Where the software deliberately limits itself.

Questions

Can I buy it today?

Not yet. TrustFabric is coming soon. Plans are priced — Starter from $499/mo, Growth $1,999/mo, Business $5,999/mo and a quoted Enterprise plan from $12,500/mo — and checkout opens when the commercial release is approved. You can request an enterprise demo now.

Is it included in my Protect or Clearception One plan?

No. TrustFabric is sold on its own subscription, separately from the Protect plan.

Does it enforce policy on every AI coding agent?

Only where it can sit in the path of the action. Pipeline gates and agent runners you operate are enforced. A developer-side hook such as the Claude Code integration is voluntary, because whoever controls the settings can remove it. Each integration shows its level.

Does AI decide what is allowed?

No. Decisions come from deterministic rules in an approved policy bundle. AI can suggest rules from a document you upload, and a person must review each one before it can be used.

Does it make us compliant with a regulation or standard?

No. TrustFabric records evidence and maps it to the controls you choose; it does not certify compliance, and its sovereignty templates are starting points, not legal advice.