Who holds what.
Daevix is an execution-time control plane. The parts that matter for a risk review are where sovereign data lives, what the platform can see, and what happens when something is refused.
Agents hold no keys.
An agent never authenticates. Every action is attributed from signals below the workload, and any credential it needs is presented by the gateway on its behalf — never handed to it.
Default-deny, every call.
All egress leaves through a gateway the agent does not control. A call outside policy is refused at the boundary and written to the record. Refusal is the platform working, not an outage.
You can hold the key.
Key custody runs a spectrum from platform-managed to fully bring-your-own, across two trust domains that do not cross. At the far end, the operator holds that key and decrypt is fail-closed without it.
What the controlplane can see.
The honest numbers here are structural, not benchmarks. Daevix is alpha and has no production fleet to quote.