BASTION

Fortified Enterprise Fleet

The access review that reviews itself.

Bastion audits the live permissions of the production GCP project that runs it, turns minimized findings into department-owned human action, and remembers approved exceptions across asynchronous investigations.

Explore the proof See the governed path

Public evidence console. The operational fleet and enterprise data plane remain IAM-private on Google Cloud.

Bastion's reviewed brand overview showing the private live fleet, its three agents, and managed controls.
Reviewed brand master · animated route effects · static SVG when reduced motion is set
3 institutional agents
52 live bindings measured
3 → 2 findings to departments
3 days observed decision continuity
Fleet inventory captured

Three agents, three responsibilities

Institutional ownership is the architecture.

Each agent has a named department, fixed tools, and a distinct workload identity. Catalog metadata describes responsibility; IAM and deterministic code enforce it.

01MANAGED RUNTIME

Orchestrator

Owns the durable investigation lifecycle, policy threshold, routing, and completion.

  • Firestore leases and retries
  • Registry + Gateway egress
  • Deterministic policy and completion gates
02READ-ONLY IAM

Access Auditor

Reads the production policy and minimizes it before any model boundary is crossed.

  • Real Cloud Asset Inventory
  • Opaque finding identifiers
  • Bounded Gemini rationale
03NO IAM READ

Escalation

A deterministic worker, not a model: delivers minimized routed findings to private human-review records with no model in the path.

  • Department allowlist
  • Idempotent review key
  • IAM denial observed

Governed production-data path

Raw IAM stops here. Context continues.

Principals, roles, resources, and policy bindings exist only inside the Auditor's deterministic tool. The model and notification boundary receive opaque, bounded data.

The reviewed production request path from Pub/Sub and Eventarc through durable ingress, managed Runtime and Gateway to the read-only Auditor and no-IAM-read Escalation agent.
Governed investigation flow · generated from the reviewed repository master
STOPS BEFORE GEMINI

principal · role · resource · binding

CROSSES THE BOUNDARY

opaque ID · category · department · score

Durable asynchronous context

A human decision outlives the process that received it.

An approved exception is keyed by an opaque finding ID and expires explicitly. A later investigation retrieves that decision, suppresses the matching work, and continues routing unrelated findings.

Observed boundary Approval on 19 Aug → deployed-path suppression on 22 Aug. Three days, not a literal week.
Human approves exceptionBounded expiry + verified reviewer
deployments + restarts
Matching work suppressedOther departments still route

Seven managed pillars

Controls outside the prompt.

The strongest boundary is one the model cannot negotiate. Managed infrastructure, separate identities, and fixed contracts remain authoritative.

01

Registry

Governed catalog and approved destinations.

02

Runtime

Identity-bearing managed orchestration.

03

Memory Bank

Context outside process memory.

04

Identity

Least privilege by institutional role.

05

Gateway

Default-deny governed egress.

06

Model Armor

Fail-closed input screening.

07

Observability

Payload-free audit and operations.

Evidence, not architecture theatre

One claim per frame.

Final gallery captures are composed from redacted, current-route observations and live in the repository. The underlying proof records are public beside them.

DEMO VIDEO · 3:53 · PUBLISHED

Four minutes. One investigation. No hidden reset.

Twelve beats connecting the catalog, live IAM counts, department action, a remembered exception, an enforced denial, and correlated operations — every frame captured from the deployed fleet and redacted before it was cut.

Known boundaries

What Bastion does not claim.

Production readiness includes saying where the proof ends. These are intentional constraints or open evidence items, not footnotes hidden from a judge.

  • Read-only operationBastion requests human review; it never modifies IAM.
  • Global model endpointCompute and state are regional; Gemini processing is global.
  • Retention, not immutabilityAudit records are retained; the bucket is not locked.
  • Event-driven todayNo deployed recurring Scheduler job is claimed by this snapshot.
  • Three-day observationTests cover longer timing logic; live proof spans three days.

Reproduce the engineering proof

The public site is the map. The repository is the record.

Read the architecture, inspect redacted evidence boundaries, and run the documented Python 3.12 offline gate from a clean clone.

Setup and testing Evidence ledger