How it works
One URL and a signing secret. No agent to install, nothing to run inside your VPC.
POST /v1/sources
Rules are plain expressions with autocomplete, versioned in the same repo as your code.
allow if actor.role in ["admin"]
Shadow mode replays yesterday so you see exactly what would have been blocked before anything is.
mode: shadow · 1.2M decisions
Every decision is signed and exportable, which is the part your auditor actually asks for.
GET /v1/audit?from=2026-01-01
Read the integration guide