Flagship application

Policy-Based Access Mediation

An adaptive Zero Trust decision overlay for IAM, PAM, CIEM, ZTNA, API authorization, cloud workloads, AI agents, and machine identities. The enforcement point stays where it is. The determination that reaches it becomes defensible.

Apply for Grant-Funded Access See the Integration Contracts

The question being asked

From a Narrow Question to a Multidimensional One

Identity-centric access decisioning is where the Hypercube produces the greatest marginal value, because the answer depends on more variables than any single product observes.

Conventional access question

Is this identity authenticated, and does its assigned role permit this action?

Mediated access question

Should this identity, using this device, from this location, under these behavioral conditions, access this specific resource, for this purpose, at this privilege level, for this duration, given current threats, vulnerabilities, business consequences, and uncertainty?

Evaluated in a single adjudication

Identity assurance and recent authentication events
Device posture, ownership, health, and compromise indicators
Requested action and privilege level
Resource criticality and data classification
Network, geographic, temporal, and behavioral context
Active vulnerabilities and exploitable attack paths
Current threat intelligence relevant to the identity or asset
Prior incidents involving the identity, asset, or workload
Separation-of-duty and regulatory constraints
Business process legitimacy and change authorization
Blast radius if the account or device is compromised
Reliability and freshness of every evidence source
Contradictions among identity, endpoint, network, and cloud signals
Reversibility and operational cost of the proposed control action

This is adaptive attribute-based access control combined with risk-based decision governance. The attributes are constructed, validated, and continuously updated before a deterministic authorization engine evaluates them.

Continuous authorization

Request, Evidence, Adjudication, Constraint

Continuous authorization inputs

01Identity
02Device
03Network
04Requested action
05Resource
06Privilege
07Behavioral context
08Threat state
09Asset criticality
10Data sensitivity
11Policy
12Time
13Uncertainty

Adjudicated access outcomes

Every request is evaluated against current identity, device, resource, and threat state. The outcome is a decision with a validity window rather than a persistent grant.

Allow
Allow with constraints
Step-up authentication
Just-in-time privilege
Deny
Escalate

Two execution paths

Keep the Fast Path Deterministic. Reserve Adjudication for the Hard Cases.

Most access decisions should never leave the deterministic engine. The reasoning layer earns its place on the requests that are genuinely contested.

Fast path: deterministic authorization

Routine access decisions stay with the deterministic engine already in place: the IAM platform, API gateway, service mesh, or a policy engine such as OPA or Cedar.

What the overlay supplies

Dynamic risk attributes
Trusted contextual attributes
Policy bundles
Threat-state updates
Resource-criticality updates
Revocation and step-up triggers
Signed decision constraints

Deep path: Hypercube adjudication

The full reasoning path is invoked only when one of these conditions holds.

Signals conflict across products
The privilege requested is unusually consequential
An identity or device is behaving anomalously
The requested action carries a large blast radius
Multiple security products disagree on the same entity
The response could interrupt production
Evidence quality is insufficient for the claim
An automated playbook proposes an irreversible action
Policy requires human review

A generative model should not independently enforce packet-level or high-consequence controls. The reasoning layer produces a structured decision that passes through deterministic policy, authority, and release gates before anything executes.

Outcome vocabulary

Ten Outcomes, Not Two

Allow and deny are the endpoints of a range. Most of the useful decisions sit between them.

ALLOW

Evidence supports the request and no constraint is warranted.

ALLOW_WITH_CONSTRAINTS

Access proceeds under narrowed scope, duration, or capability.

STEP_UP_AUTHENTICATION

Assurance is raised before the action continues.

JUST_IN_TIME_PRIVILEGE

Elevated rights are granted for a bounded interval tied to a task.

LIMIT_SESSION

The reachable surface or session lifetime is reduced.

DENY

The request is refused with the basis recorded.

REVOKE

Existing tokens, sessions, or entitlements are withdrawn.

ISOLATE

The endpoint or workload is separated from the network.

QUARANTINE

The asset or artifact is held pending examination.

ESCALATE_FOR_REVIEW

The decision is routed to the required human authority.

Contract

Canonical Access Evaluation

The request carries the subject, action, resource, context, evidence references, and the policy envelope that bounds what the answer is permitted to be.

POST /v1/cyber/access/evaluate

{
  "request_id": "req_01",
  "tenant_id": "enterprise_01",
  "mode": "shadow",
  "subject": {
    "type": "human",
    "identity_id": "user_4821",
    "roles": ["cloud_operator"],
    "assurance_level": 3
  },
  "action": {
    "name": "assume_privileged_role",
    "requested_duration_minutes": 30
  },
  "resource": {
    "resource_id": "production_payments_cluster",
    "criticality": "critical",
    "data_classification": "restricted"
  },
  "context": {
    "device_id": "device_991",
    "device_managed": true,
    "network_zone": "remote",
    "authentication_method": "phishing_resistant_mfa",
    "behavioral_deviation": "elevated"
  },
  "evidence_refs": [
    "idp:event:123",
    "edr:event:456",
    "cnapp:finding:789",
    "siem:incident:321"
  ],
  "policy_envelope": {
    "workflow": "privileged_access",
    "jurisdiction": ["US"],
    "maximum_autonomy": "recommend_only",
    "human_approval_required": true
  }
}

Governed decision response

{
  "decision_id": "dec_01",
  "decision": "allow_with_constraints",
  "controls": [
    "step_up_authentication",
    "limit_session_to_15_minutes",
    "disable_bulk_export",
    "record_privileged_session"
  ],
  "risk_score": 0.82,
  "confidence": 0.88,
  "uncertainty": 0.08,
  "contradiction_status": "material_contradiction_resolved",
  "primary_hypothesis": "legitimate_access_with_elevated_account_risk",
  "alternative_hypotheses": [
    "credential_compromise",
    "unauthorized_privilege_escalation"
  ],
  "approval": {
    "required": true,
    "minimum_authority": "security_duty_manager"
  },
  "validity": {
    "expires_in_seconds": 300
  },
  "rollback": {
    "supported": true,
    "instruction": "revoke_session_and_restore_prior_entitlements"
  },
  "provenance": {
    "evidence_manifest_hash": "sha256:...",
    "policy_version": "privileged_access_12.4",
    "reasoning_configuration": "cyber_adjudication_3.1"
  }
}

The response is not allow or deny. It is an evidence-linked, constrained, expiring, reversible, and authority-governed decision artifact.

Zero Trust architecture

Where the Overlay Sits in the Reference Model

The reference architecture separates the point that decides from the point that enforces. The overlay strengthens the decision and leaves enforcement with the grantee organization.

Component	Contribution	Owner
Policy Information Point	Aggregates and validates identity, device, network, workload, data, threat, and business attributes.	ArtOfTheHack
Policy Engine	Receives contextual risk, uncertainty, evidence, and recommended constraints; deep adjudication is invoked for exceptional requests.	Shared
Policy Administrator	Produces a signed, bounded, expiring instruction for the existing control platform.	Shared
Policy Enforcement Point	Remains the grantee organization IdP, PAM, ZTNA gateway, API gateway, proxy, service mesh, endpoint platform, or cloud control.	Grantee organization

The safest architecture augments the deterministic policy engine rather than replacing it. Related reading: framework alignment and the Zero Trust decision engine.

Worked example

Privileged Cloud Access Anomaly

A privileged administrator requests access to a production donor and case-data environment. Eight systems report on the same moment and they do not agree.

What the existing systems report

Successful phishing-resistant authentication from the identity provider
A managed-device record from device management
An endpoint anomaly from EDR
A newly assigned cloud entitlement from CIEM
A high-severity workload vulnerability from CNAPP
A geographic anomaly from the SIEM
No prior incidents for the user
An open and apparently legitimate change ticket

What the reasoning layer does

Validates the provenance and freshness of every signal
Detects that the managed-device record is stale
Determines that the endpoint alert and geographic anomaly raise risk independently
Confirms the change ticket but finds it authorizes maintenance, not privilege escalation
Maps the behavior to candidate credential and cloud-administration techniques

Competing hypotheses tested

Legitimate administrator under unusual conditions
Compromised credentials
Compromised endpoint
Unauthorized entitlement change

Response options simulated

Full denial
Token revocation
Endpoint isolation
Step-up authentication with a restricted session
Fifteen-minute just-in-time privilege with session recording

Governed outcome

Selects the least-disruptive action that materially reduces risk
Requires a security duty manager to approve the temporary privileged session
Sends the approved restrictions to PAM, the identity provider, and the cloud platform
Monitors the session and revokes access automatically if risk increases
Records the outcome for calibration

The optimization is not better detection. It is better governed decision-making across detection, access, response, and mission continuity.