Security & compliance

The guardrail: autonomy without an open bar

For autonomous validation without supervision, "can run any command" is a risk, not a feature. TecnicaiT is bounded by design across several layers. Nine guardrails: the first ones contain, the last ones steer.

Closed action vocabulary

The set of actions it can run is validated against a schema. Anything outside the vocabulary is rejected before it executes.

Protected paths in two layers

A hardcoded universal layer (engine, version control, secrets, dependencies) plus a per-client configurable layer. No finding can touch what is protected.

Hard budgets per procedure

Limits on actions, tokens and time per run. Exceeding them triggers a controlled abort, never an infinite loop or runaway cost.

Green tests as a mandatory gate

No applier change reaches a PR without passing the test suite. If tests stay red it reverts or retries with self-reflection; it never forces the commit.

Signed audit trail

Every run is cryptographically signed, with per-step screenshots, and tied to the versioned procedure that originated it. Reproducible traceability for certification evidence.

Your key, your model

Bring your own key (BYOK) by default: the AI provider key is yours, inference cost is yours and transparent, and the data flows through your account.

Per-organization quotas

A monthly AI spend cap and a concurrent-run limit per organization. Once the cap is reached, new runs do not start: cost cannot run away.

Minimal permissions on your repository

It delivers changes as Pull Requests on ephemeral branches: it never writes to your main branch and never asks for organization administration. Your branch protection stays in charge.

Findings that survive their own self-critique

Every finding goes through an adversarial check before it reaches you: self-critique discards the ones that cite no real evidence, visual findings require a second independent judgment from another model, and nothing auto-applies without contrasting the finding against the real file contents. The discarded ones are not hidden: they are kept with their reason, as a confidence signal for the report.