Security review of Parmana

This page is for the person who has to decide whether Parmana is safe to put in front of an AI agent that can act on your business systems. It lists what Parmana checks, what it records, how a third party can verify a record, and what it does not prove.

What Parmana checks before an action runs

• Every action is decided by a named, versioned policy. The record stores a hash of the policy content that was actually evaluated, not just its version number.
• A policy that approves an action must require a signed human approval for it. Without one, the policy is refused at load time.
• If a required fact is missing, the action is refused. Missing data is never treated as a pass.
• Declared facts are checked against the real intended action, and where a connector can confirm a fact from its own system, it is checked there.
• An action is refused, not retried, when its approval is missing, its signature does not verify, or its policy no longer matches the approved content.

Who can change a policy

• Policy changes are proposed by one authenticated human and approved by a different one.
• Each approval needs a separate signed step-up envelope, which expires after 120 seconds and can be used once.
• Each approval is recorded as a signed record chained to the record before it, so a deleted or reordered record is detectable.
• Startup and CI checks compare the live policy file with its approval record, and a mismatch fails.

What is recorded, and who can verify it

• Each executed or refused action produces a signed Execution Trust Record or Refusal Record.
• Public keys are published at /.well-known/jwks.json, so a third party can verify a signature without a Parmana credential.
• Public verification endpoints check a signed record or audit event without database access.

Caller type

An AI agent, a person, and a service account go through the same execution path and produce the same record shapes. Only policy authorship is restricted to verified humans.

What the evidence does not prove

• A signed record does not prove the policy itself is correct. It proves which policy content was in force.
• A signed record does not prove the external system performed the action. It records what Parmana released.
• Any person holding a provisioned checker credential can approve a policy change. Review which checker credentials are provisioned.

Technical detail is in the documentation. Questions about a specific control: see the questions page.