scriptsanction
Each stands alone. Composed, they are Sanction.
Requisition makes the record honest. Ultraviolet is a second operator with a different threat model. Trinity makes the agent a governed actor. beam_mcp carries the calls and holds no authority. The four together are Sanction. Sanction OS is where it runs, not a member of it.
how it works
One mechanism, configured per deployment.
Witness
Every approving act is a signed record carrying attributes someone can vouch for: identity, qualification, billet, presence at the equipment, time. A person, a device, a decoder, or an agent can each be a witness. They are not interchangeable.
Predicate
Each deployment declares, per class of action, what an independent second act means. The gate asks one question: does this witness set satisfy the rule in force? A rule nobody on the current roster could satisfy is refused when it is configured, with a reason, instead of at three in the morning.
Receipt
Every outcome, executed or refused, seals a receipt recording the rule, the witnesses, and the evaluation trace. A stranger can re-run the decision offline and reach the same verdict without asking permission.
Three rules the language enforces, not convention
- The proposer is never a witness. Naval aviation's "no one inspects their own work", made structural.
- A machine witness never counts toward independence. A diagnosis can constrain what is reachable. It cannot stand in for a person.
- A neural act is never sole for an irreversible action. Configurable, but the shipped default refuses, and the receipt records the choice.
What never loosens
- Approval binds to the exact bytes and is re-verified at execution. The same primitive as PSD2 dynamic linking and FIDO transaction confirmation, generalized beyond payments and extended to multi-party approval.
- Policy only narrows. An advisory hold can escalate but never approve. If the gate is unavailable, nothing runs.
- Silence is a finding. The schedule is declared, so a check that never opens is as visible as one that fails.
three layers
Each layer holds a guarantee the layer below cannot.
Requisition alone has limits Requisition alone cannot fix. The four together have different limits. The platform adds what neither can without one. Each claim is tested one configuration at a time.
The platform is described on its own page: Sanction OS.
What it does not do.
It does not make judgments correct. Discretion, whether an emergency waiver, a departure from specification, or "as the commanding officer sees fit", is recorded as a decision by someone with the authority to make it, bound to the bytes, with a reason. The system never evaluates the judgment.
Two signatures do not stop rubber-stamping. The clinical literature is blunt that an independent double check is a weak safeguard when it is the only one. What deters falsification is comparing the claimed outcome against the observed state afterward.
Presence is graded, not absolute. A static code on a piece of equipment can be photographed and replayed. That is evidence, not proof, and the receipt says which level it holds. An action requiring more than an asset can attest is refused with the gap named.
Where each part is today.
| System | Role | Status | Page |
|---|---|---|---|
| Requisition | authority of record | in production inside Sanction OS; patent pending | Requisition |
| Ultraviolet | purple-team SOC | open source, Apache-2.0 | Ultraviolet |
| Trinity | governed agent | open source, Apache-2.0 | Trinity |
| beam_mcp | MCP server core | 0.10.1 on Hex, Apache-2.0 | beam_mcp |
| Sanction OS | platform | early access | Sanction OS |
The systems are specified for the extreme case: defense, healthcare and other high-sensitivity environments, with posture configured downward by declaration. The full specification, the fielded scope and the accreditation status for a given environment are stated separately, to qualified program offices, on request.