SECURITY
Autonomous where it should be.
Constrained where it must be.
Changefy is built around a simple rule: reasoning is free to explore, but action is bounded by policy and gated by a human. Here is how that boundary is enforced end to end.
ARCHITECTURE
- User request
- Reasoning
- Context layer
- Policy engine
- Plan
- Human authorization
- Execution runner
- Target systems
- Verification
- Evidence ledger
Least privilege
- Changefy holds only the permissions it needs for the connection it's using, nothing broader.
Scoped credentials
- Credentials are scoped and short-lived per execution, not a standing admin identity.
Policy enforcement
- Every plan is classified by risk and environment before it's allowed to proceed.
Human approval
- Anything above the configured risk threshold stops for an explicit approval.
Execution boundaries
- Execution runners are constrained to the environment and blast radius in the approved plan.
Immutable activity history
- Every investigation, plan, approval, execution step, and verification is recorded and cannot be edited after the fact.
Secrets stay in the execution environment
- Credentials used to act on target systems never leave the execution boundary.
Stop-on-deviation
- If a system doesn't match what the plan expected, execution halts rather than improvising.
Changefy does not currently hold third-party compliance certifications. We publish our architecture and controls here so you can evaluate them directly, and we work with customers on the assurances their own compliance programs require.