This matrix is dated. It is checked against the daemon's custody wiring (internal/platformd) and the custody resolvers (internal/custody) in the evaluation repository, and the check runs in the site test suite. A model that is not wired is a startup refusal, never a silent downgrade.
These pages describe the product. They are not a certification or a legal opinion.
How the enforcement label is computed
One function computes the label from the custody model and the wiring, and every surface shows that label: enforced (an enforcing custody model with a wired path), observed (pass-through, always: AAES records and cannot prevent), or inventory (anything else, including an enforcing model with no wired path and a wildcard scope). Understating enforcement is the safe direction; no surface recomputes the label.
The matrix
| Custody model | Who holds the credential at use | Enforcement label | Build status |
|---|---|---|---|
customer_vault | The client's secret manager; AAES holds a reference and fetches at the moment of use. | Enforced when wired. | Implemented: the enforcing path. Served only when -custody-sources configures a vault connection; a capability that declares it without one is refused at startup, naming what is missing. Brokered execution via POST /v1/brokered. |
inline | AAES, in its encrypted store (AES-256-GCM under a local master key). | Enforced when wired. | Implemented; lab-only. The daemon refuses to start with an inline capability unless -allow-inline-custody is passed. Demonstrated in the evaluation demos; not a GTM path. |
pass_through | The actor holds its own credential. | Observed, always. Cannot print enforced. | Implemented. The connector gate refuses to execute a pass-through capability; the actor's outcome report is recorded as the actor's claim, excluded from the coverage numerator. An actor that acts without asking leaves no AAES trace. |
identity_federation | The client's identity provider, by token exchange. | Would be enforced when wired; today a registration is refused. | Designed; refused at startup. No token issuer is wired, so the per-decision token cannot be minted. Not a GTM default. |
customer_broker | The client's own broker, inside the client's deployment. | Would be enforced when wired; today a registration is refused. | Designed; refused at startup. No client-hosted broker client is wired. Not a GTM default. |
Nothing in this matrix is planned or untested without saying so: the two implemented enforcing models carry tests that fail if the wiring changes; the two unserved models fail at startup with the reason, which is the tested behaviour. A capability whose declared model this build does not serve never reaches a governed call.
Limits
- The label is about the path, not the estate. Work that bypasses AAES is invisible to AAES, on every model.
- Enforced depends on deployment. A registration an operator writes is a claim; the wiring check happens at startup, and the bypass question stays open at the client's firewall.
- This matrix ages. The review date above is the claim. The site test suite refuses a matrix whose statements no longer match the wiring.
Check which model your workflow's credential path lands on in a scoped evaluation.
Related pages:
This note: https://aaes.ai/library/capability-matrix.html
Trust model: https://aaes.ai/library/trust-model.html
Scope: https://aaes.ai/library/scope.html
Scope an evaluation: https://aaes.ai/contact.html?ref=library-evaluation