# AxiomGate — AI Agent Security & Architecture Audits

> Deterministic security assessments, capability boundary enforcement, and cryptographic evidence verification for autonomous multi-agent systems.

## Summary
AxiomGate provides scoped static security reviews of agent systems. Automated discovery varies by framework and source pattern; reports state coverage limitations. Source access and retention are agreed per engagement.

## Core Capabilities
- **OWASP Mapping:** Findings include excessive agency (LLM06:2025). A category mapping is not a claim of complete OWASP coverage or proof of exploitability.
- **Deterministic Static AST Linting:** Pre-execution detection of arbitrary shell execution, unattenuated subagent delegation, and unverified authority propagation via `axiomgate-lint`.
- **Cryptographic Evidence Integrity:** Evidence digests and HMAC-protected audit records support tamper detection against trusted verification material. Bounded TLA+ results concern the governance model, not customer applications.
- **Executive & Engineering Deliverables:** Four-page executive report, findings and remediation guidance, and machine-readable evidence. A posture score is withheld when coverage is insufficient. Reports are not security or compliance certificates.

## Open Foundations (PyPI)
- `axiomgate-kernel` (v0.12.1): Deterministic governance kernel enforcing capability boundaries and cryptographic journal sealing. Source-available under PolyForm Noncommercial 1.0.0.
  - Link: https://pypi.org/project/axiomgate-kernel/0.12.1/
- `axiomgate-lint` (v0.2.2): Zero-dependency Python AST security linter for agent orchestrators. Open-source under MIT.
  - Link: https://pypi.org/project/axiomgate-lint/0.2.2/

## Commercial Audit Packages
- **Dual-Agent ($290–$490 USD):** 1–2 agents, limited tool surface, instant machine-audit delivery target under 3 minutes after approved checkout and available source; 24-hour human fast-path available for +$190.
- **Multi-Agent System ($590–$990 USD):** 3–5 agents, delegation routing and multi-agent capability boundaries, automatic machine-audit delivery target under 3 minutes after approved checkout and available source. Includes 1 complimentary re-scan within 30 days.
- **Agent Fleet ($990–$1,990 USD):** 6–9 agents, complex tool access and custom framework review, automatic machine-audit delivery target under 3 minutes after approved checkout and available source. Includes 1 complimentary re-scan within 30 days.
- **Enterprise Bounded ($2,490 USD):** Exactly 10 agents within the published source and execution limits. Checkout and delivery are automatic after verified payment. Includes 1 complimentary re-scan within 30 days.
- **Enterprise Custom ($1,990–$4,900 USD):** 10+ agents, multi-repo, bespoke governance scope or full monorepo outside the published bounds. Report preparation starts immediately, but human review is required before delivery; a private single-repo source can still use the autonomous bounded path.
- **Architecture Remediation & Advisory ($85 USD/hour):** Focused remediation guidance after findings.
- **Team Platform ($149 USD/month or $1,490 USD/year):** Recurring team access.
- **Continuous Audit Retainer ($490 USD/month or $4,900 USD/year):** Monthly re-scans, delta history, CISO reports and private portal access.

## Site Map
- **/** — product overview, live scanner, one worked finding, public evidence, pricing.
- **/order.html** — the audit order flow: package selection, scope, NDA clickwrap, Stripe checkout or invoice request.
- **/methodology.html** — the ten review areas, the OWASP LLM risk mapping and the architecture pattern demonstrations.
- **/services.html** — engagements beyond a one-off audit: architecture remediation, team platform, continuous audit retainer.
- **/privacy.html** — data handling, sub-processors and automated-decision boundaries.

## Commercial & Billing Channels
- **Delivery semantics:** The automated machine path targets under 3 minutes after approved checkout and available source. Evidence level: the fulfillment chain from verified payment through analysis, artifact generation, Vault and email delivery is implemented and tested end to end, including verified-payment test transactions that reached delivered state. It has not yet been observed on an external customer transaction, and is not described as production-validated. The optional $190 priority add-on is a separate operator fast-path; Enterprise Custom requires human sign-off because its scope is bespoke or outside the published bounds.
- **Stripe:** Audit package prices are in USD; available payment methods appear at checkout.
- **B2B invoicing:** Frilans Finans invoicing can be requested. Currency, tax treatment, payment instructions and due date are confirmed on the issued invoice.
- **Order intake:** orders@axiomgate.org
- **General contact:** contact@axiomgate.org
- **Customer support & re-scan:** support@axiomgate.org
- **Security disclosures:** security@axiomgate.org
- **Billing & VAT:** billing@axiomgate.org
- **Founder:** robin@axiomgate.org
- **Client relations:** oskar@axiomgate.org

## Leadership
- **Robin Svensson:** Founder & AI Agent Security Architect (GitHub: https://github.com/robin-svensson, LinkedIn: https://www.linkedin.com/in/robin-svensson-a1989a434/)
- **Oskar Ottosson:** Partner & Client Relations (oskar@axiomgate.org)

## Security & Privacy Boundaries
- **Source handling:** Static analysis runs locally without executing the submitted application. Source retention and access are agreed per engagement; order records and reports are separate records.
- **Model use:** The static scanning pipeline does not require a model provider.
- **Mutual NDA:** Intake includes mutual confidentiality terms and a receipt. The clickwrap has not been reviewed by external counsel; it is not represented as an executed negotiated agreement.
- **Measurement:** The public site carries no third-party analytics and no advertising pixels. A first-party, cookie-free conversion measurement module ships with the site but is inactive; no endpoint is configured, so no event leaves the browser.