Comparing the six positions

Every AI gateway routes. pistra decides, and proves what it decided.

That sentence has been the heading on our compare page since before post 1 went up. The six position posts since then each took one place on the path, said what it sells and to whom, said who should use it anyway, and left one question open. Those questions are collected below, followed by three you can ask of anyone on the figure.

The rows

Custody, posts 4 and 8. A marketplace occupies the provider’s position, so its record is kept by the party being checked and paid on the purchase. The cloud’s own service keeps its record in the tenancy that ran the call, under that tenancy’s IAM, so a verifier outside the account is trusting whoever administers it.

What the provider saw, posts 5 and 6. A proxy that rebuilds the request in its own shape cannot say what the provider received, because what survives is whatever that shape knew the week it was written. A cache hit never reaches the provider, and on a similarity hit the prompt in the log is not the one that produced the answer.

Vocabulary and inputs, posts 7 and 9. A gateway thinks in routes and headers, so its AI plugin phones a detector. A detector answers about the string it was handed, without the credential, the budget or the bytes the provider got. Composing those into a decision is the job of whatever holds the connection.

The witness, post 10. A governance platform owns the binder and cannot produce evidence of a call it did not witness. The runtime that did has to hand over a record that is complete, nothing altered or removed from the middle, and bounded, saying what it does not contain.

The website says Access, Enforce and Prove. Access is decide and meter. Enforce is decide and redact. Prove is record.

Three questions

Each row above is a question about a position, and positions do not move. These three turn the rows into a result you get yourself. Ask them of any vendor on the figure, and of us.

1. Which node signed this record?
2. What chains it to the one before?
3. Which party, besides the store the records sit in, has to be honest for that check to hold?

A product that has an answer to all three keeps a record you can verify. A product that has an answer to the first two keeps a record that is tamper-evident as long as nobody cut it short. A product with an answer to none keeps a log, and a log is fine, as post 3 said, until somebody asks.

We are not going to fill in the answers for anyone else, and no project is named here for an absence. Ask, and read what comes back.

Our answers

The first two are one command. Every record pistra writes is chained to the previous one on that node and signed with that node’s key, and pistra audit verify reads a trail, in any order and with anything interleaved, and reports every record that was altered, removed from the middle, moved or forged, by sequence number.

The third is the cluster. A chain by itself cannot show that it was not cut at the end, so about once a minute, and once more when it shuts down, each node offers its signed head to the raft cluster it belongs to. The cluster checks the signature and keeps a day of heads per node in replicated state where compaction cannot reach them, and pistra audit verify -heads reports a trail that stops short of a witnessed head. The party that has to be honest is a quorum of the cluster. That is why the demonstration is two nodes and not one: a cluster of one witnesses itself, which proves nothing on its own, and there the collector is the witness. Raft holds each node’s head and never the records. The records go to your collector, in your account.

Two limits belong to that answer. A key used by somebody other than the node is not something the trail can show. It proves what the key signed, and keeping the key where only the node reaches it is the deployment’s job. And admitted requests are absent, on purpose, because the record is bounded and says so.

All posts