Question 1

How is MACAW different from detection-based AI security?

Accepted Answer

Detection-based security tries to identify bad behavior after it happens (or as it happens). MACAW prevents unauthorized behavior from happening in the first place.

| Approach | How It Works | Limitation |
|----------|--------------|------------|
| Detection | Pattern matching, anomaly detection, ML classifiers | Attackers evolve, false positives/negatives, cat-and-mouse game |
| Prevention (MACAW) | Policy enforcement, cryptographic verification | If it's not allowed, it doesn't execute. Perio

Question 2

What's the difference between guardrails and access control?

Accepted Answer

Guardrails are framework-specific behavioral constraints. Access control is infrastructure-level policy enforcement.

Guardrails:
- Built into a single framework (LangChain, OpenAI, etc.)
- Apply to that framework's operations only
- What happens when frameworks compose in a workflow?

Access control (MACAW):
- Works across all frameworks in your stack
- Enforces at every boundary, regardless of framework
- Policies follow the user, not the tool

The composition problem: Your agent uses LangChai

Question 3

What is deterministic security?

Accepted Answer

Deterministic security means:

Same request + Same policy + Same context = Same decision (every time)

This matters because:

Predictable: You know what will happen before it happens.
Testable: You can write tests that always pass or fail consistently.
Auditable: You can explain exactly why something was allowed or denied.
Compliant: You can prove to auditors that controls work.

MACAW's policy engine is deterministic. Given the same inputs, you get the same output. No AI-in-the-loop for secur

Question 4

Why is determinism important for AI security?

Accepted Answer

AI behavior is inherently non-deterministic. The same prompt can produce different outputs.

Security requires guarantees:
- "User X cannot access resource Y" must be true 100% of the time
- Not "probably true" or "usually true"
- One failure = one breach

If your security decisions depend on AI judgment:
- Different runs → different decisions
- Prompt injection → manipulated decisions
- Model updates → changed behavior
- No audit trail that reproduces

MACAW keeps AI out of the security decisio

Question 5

What does "prove, don't promise" mean?

Accepted Answer

Many AI security tools promise safety through behavioral patterns:
- "Our classifier detects 95% of prompt injections"
- "Our guardrails usually prevent harmful outputs"
- "Our filters catch most sensitive data"

MACAW proves security through cryptographic verification:
- Every operation is signed by an authenticated identity
- Every decision is traceable to a specific policy rule
- Every workflow has a hash-chained audit trail

You can show an auditor the exact chain: User X → authenticated wit

Question 6

What are authenticated workflows?

Accepted Answer

An authenticated workflow is a sequence of AI agent operations where every boundary crossing is protected by intent (policy) and integrity (cryptography).

1. Every step is verified - Each operation carries cryptographic proof of authenticity
2. Identity is maintained - User identity flows through all steps (delegation, not impersonation)
3. Integrity is preserved - No tampering between steps (signed requests and responses)
4. Permissions narrow - Each delegation can only restrict, never expand

Question 7

What are authenticated prompts?

Accepted Answer

An authenticated prompt is an LLM input that:

1. Has verified origin - Traced to legitimate source (your application)
2. Is integrity-protected - Content unchanged since creation
3. Carries identity - Associated with authenticated user
4. Is signed - Cryptographic proof of authenticity
5. Tracks lineage - Full derivation history as prompts evolve

Lineage tracking: As prompts are modified, augmented, or derived (e.g., RAG adds context, tools inject results), MACAW tracks the entire chain. This

Question 8

What is authenticated context?

Accepted Answer

Authenticated context is like a user-level app vault - verified, tamper-evident state for each user's AI operations.

What it provides:
- User isolation - Alice can't corrupt Bob's memory. Each user's context is cryptographically bound to their identity.
- Authorized updates only - Memory modifications must pass policy checks, just like any other operation.
- Tamper-evident state - Context is hash-chained, so any unauthorized modification is detectable.
- Multi-step workflow state - Store and ve

Question 9

What is a distributed zero trust mesh?

Accepted Answer

MACAW implements a distributed zero trust mesh - a network of cryptographically-enabled enforcement points where every participant can verify every other participant.

Key property: Each participating element has its own signing keypair:
- Every agent gets a keypair
- Every prompt gets signed
- Every tool in the workflow gets a keypair

When Agent A invokes Tool B, the request is signed by A, verified by B, and logged with both identities. Identity and intent are preserved, authentic, and attest

Question 10

What is Zero Trust for AI agents?

Accepted Answer

Zero Trust means "never trust, always verify" - even for internal requests.

Applied to AI agents:
- Agents are not trusted by default - Must prove identity and authorization
- Every operation is verified - No implicit trust from previous operations
- Least privilege - Agents get minimum permissions for the task
- Assume breach - Design as if attackers are already inside

Traditional security: "Inside the network = trusted"
Zero Trust: "Every request must prove it's authorized, regardless of sou

Question 11

What security guarantees does MACAW provide for multi-agent workflows?

Accepted Answer

Multi-agent workflows create unique risk: any agent could be compromised, manipulated, or produce malicious outputs. MACAW provides four guarantees:

| Guarantee | What It Means |
|-----------|---------------|
| Blast radius containment | Compromised Agent B can't affect Agents A or C. Each agent's identity is cryptographically independent. |
| Privilege cannot escalate | Permissions only narrow through delegation. A delegates [read, write] to B → B gets at most [read, write], never more. |
| No

Question 12

What are attestations?

Accepted Answer

Attestations are cryptographically signed approvals that allow specific operations to proceed. They can come from humans OR programmatic sources.

How attestations work:
1. Policy requires an attestation for certain operations
2. Operation is blocked until attestation is provided
3. Approver (human or system) provides signed approval
4. Operation proceeds with cryptographic proof of approval

Use cases:
- Human approval: Manager sign-off on high-value actions
- Programmatic approval: Automated s

Question 13

When should I require attestations?

Accepted Answer

Require attestations when you need explicit approval before an operation:

| Scenario | Attestation type |
|----------|------------------|
| High-value transactions | Human (manager approval) |
| Compliance-sensitive access | Human (privacy officer) |
| Automated validation checks | Programmatic (system verifies conditions) |
| Cross-system operations | Programmatic (external system confirms readiness) |
| Policy exceptions | Human (explicit sign-off) |

Balance friction vs. control: Attestation

Question 14

Can I use MACAW with other security tools?

Accepted Answer

Yes. MACAW is infrastructure, not a replacement for your security stack.

| Integration | How |
|-------------|-----|
| IdP (Okta, Auth0, Azure AD) | Identity Bridge - MACAW uses your existing identity |
| SIEM (Splunk, Datadog) | OTEL export - Audit logs flow to your observability stack |
| API Gateway | MACAW works behind your gateway, adds AI-specific controls |
| Network Security | MACAW operates at application layer, complements network controls |

MACAW adds the AI-specific controls that e

Security Model