Refused
Calls signed with a key that is not on the signed list, or that belongs to another tenant, are refused at every entry point: code assistant, model gateway, chat guard and memory gateway.
OWAI OS / DEMO
One run.
Every decision on screen.
A recording of OWAI OS running on a single server. Every card in the video was drawn from the system’s own responses during that run.
WHAT YOU SEE
Stopped. Signed.
Forgotten. Detected.
Held, then signed
A proposed code change waits until a named approver signs it. The gateway decision and the approval each carry their own signature.
Verified
The gateway checks that exactly the approved change is applied, and the downloaded package matches what was signed.
Memory under control
A password the agent wants to remember is refused. Data waiting for consent cannot be read. Forgotten data stays forgotten, even after a restore.
Detected
A bulk write into the vector store that bypasses the gateway is detected, and the altered entries are rejected.
WHAT THIS RECORDING IS
An honest
pilot build.
The model, the search index and the vector store are test stand-ins, labelled on screen. The model returns a fixed response, so the demo shows what OWAI OS does with a proposal, not the quality of a model.
OWAI OS is in pre-production. The recording shows one server without high availability; it is not a production deployment and carries no certification. Consent is recorded, not verified.
A pilot runs the same checks on your server, with your task and your data, within scope agreed in the pilot terms.Discuss a pilot