Prism-Shield — Zero-Trust AI-to-DAG Execution Gateway

Unvetted probabilistic output must not become deterministic side effects

Security and risk teams are being asked to ship LLM and multi-agent systems into workflows that already move money, change underwriting decisions, and write to systems of record. The failure mode is not a chat hallucination — it is an agent extraction becoming a database write, a wire transfer, or an approval with nothing cryptographic in between. Prism-Shield is the zero-trust gateway between agent extractions and your enterprise engines: canonicalize, policy/schema check, seal a ParameterManifest, enforce, KMS-attest, then execute or escalate to human review.

Stage: v0.2 pilot-hardening — design-partner pilots under EULA. Apache-2.0 open core, version 0.2.1, depends on prismmanifest>=0.3.4. Install with pip install "prism-shield==0.2.1".

Excessive agency and unvetted inputs

How Prism-Shield works

AI agent / graph extraction        ← untrusted
      ↓
PrismShieldGateway
  policy · schema · canonicalize
  seal ParameterManifest FlatBuffer
  C++ enforce_fb or Python hard gate
  KMS envelope Ed25519 attestation
  replay receipt · HITL escalation
      ↓
Enterprise DAG                     ← database / payments / underwriting

1. Resolve policy and schema — Unknown policy_id or schema_hash refuses. The registries are fail-closed allowlists — Prism-Shield never invents trust for an ID it has not seen.
2. Canonicalize with session and tenant binding — Numeric claims become exact micro-units with BLAKE3 digit fingerprints, bound to session_id and tenant_id so a decision cannot drift or float.
3. Policy pre-filter — Confidence floors, required fields, and the DAG allowlist decide the ACCEPT / REVIEW / REFUSE candidate before anything is sealed.
4. Seal a ParameterManifest — An ACCEPT candidate is mapped to a ParameterManifest, signed through the KMS envelope backend (Azure Key Vault, AWS KMS, GCP, or local), and sealed as a FlatBuffer.
5. Enforce at the Group-3 boundary — The C++ enforce_fb path runs when the in-process library is loaded (gate_path=inprocess); otherwise the Python enforce_group3_boundary hard gate runs. Same contract, different latency.
6. Record replay and attest — A replay receipt binds session_id to the canonical digest, so the same sealed decision cannot be replayed into the DAG. Consumers re-verify with verify_attestation().
7. Execute or escalate — ACCEPT returns sealed bytes to the DAG. REVIEW seals a PASS_WITH_HUMAN manifest with a real attestation and enqueues an escalation_id for the review UI. REFUSE hard-blocks.

TrustDecision

Any DAG works and the adapters ship with the package: the generic @protect_execution_dag decorator, a PrismShieldNode for LangGraph / ChorusGraph / CrewAI graphs, or an imperative await gateway.verify_and_authorize(payload, context) call. ChorusGraph is optional, never required.

Pricing — metered on Verified Execution

A Verified Execution is one verify_and_authorize() call. ACCEPT, REVIEW, and REFUSE each consume one unit, because the customer pays for the trust boundary rather than only the happy path.

Hosted human-in-the-loop reviewer seats are Coming for Team and above — design-partner and waitlist access by email, with no purchase button until the hosted control plane ships. The local escalation queue and self-hosted review UI are in the open core today. Sub-millisecond enforcement is a property of the C++ sidecar that ships with Business and Enterprise, not of the free Python gateway.

To start a pilot or join the waitlist, email info@insightits.com with the subject SHIELD. Commercial license / EULA: /legal/prism-shield-commercial.html. Stripe Team/Business Buy is commercial entitlement (not hosted HITL). Overage above included Verified Executions is billed manually or on contract until metering ships.

Enterprise controls — control-mapped, not certified

Prism-Shield ships a control map that lines its capabilities up against illustrative Trust Services Criteria so your security review has something concrete to read. That packet is documentation, not an attestation: no CPA report has been issued, and control-mapped does not mean certified.

Questionnaire packet: control map, agent → gateway → DAG data-flow diagram, key custody diagram, retention policy for audit and escalation queues, incident response contact, and a red-team summary scheduled before v1.0.

Is / is not

Pair with Prism-Eval

Prism-Eval is the CI red team: it adversarially tests digit drops, OCR column shifts, and injections against your extraction path before you merge. Prism-Shield is the runtime gateway that enforces the boundary once that code is live. They do not replace each other — test in CI, then enforce in production.

CI (Prism-Eval) → merge → Runtime (Prism-Shield gateway)

Prism stack

• PrismGuard — who may speak — prompt-injection firewall at the input edge
• Prism-Eval — CI red team — adversarial digit-drop and injection tests before merge
• PrismManifest — which numbers may execute — the signed ParameterManifest primitive Shield seals
• Prism-Shield — runtime gateway — enforce the boundary in production
• PrismShine — whether the answer is grounded — evidence-aware verdicts

Source: GitHub · PyPI 0.2.1 · open in Codespaces · test in CI first with Prism-Eval

Capabilities

Fail-Closed Policy & Schema

Unknown policy_id or schema_hash refuses. Versioned policies and published schema hashes are allowlists, so the gateway never invents trust for an ID it has not seen.

Sealed ParameterManifest + KMS Attestation

ACCEPT seals a FlatBuffer ParameterManifest signed through a KMS envelope backend (Azure Key Vault, AWS KMS, GCP, or local), enforced by the C++ gate when loaded, else the Python hard gate.

ACCEPT / REVIEW / REFUSE

REVIEW seals a PASS_WITH_HUMAN manifest and queues an escalation for human review; REFUSE hard-blocks. Replay receipts stop a sealed decision being replayed into the DAG.

Install

pip install prism-shield (pin ==0.2.1). Apache-2.0 open core; commercial SKU under EULA. Soft CTA SHIELD — mailto:info@insightits.com?subject=SHIELD.

Pricing

Insight ITS product. Developer $0/mo (10,000 verified executions) · Team $299/mo (100,000, Stripe flat) · Business $999/mo (500,000, Stripe flat) · Enterprise $35k–$120k+/yr (email SHIELD). Overage above included executions billed manually / on contract until metering ships. Hosted HITL Coming for Team+. EULA: /legal/prism-shield-commercial.html.

Frequently asked questions