Autonomous Policy Engine
Security policy, written in plain English. Enforced everywhere.
APE turns natural-language policy statements into structured, enforceable rules, maps each one to the compliance control it implements, and records every enforcement decision in a tamper-evident, blockchain-style audit trail you can verify — not a log file you have to trust.
Checking live status…
Why APE
Perimeter tools fail quietly. Recent security reporting has described attackers compromising enterprise firewalls not with a single dramatic exploit, but by chaining configuration weaknesses and known flaws together until a trusted device becomes the way in. The hardware was deployed and licensed. What failed was the configuration sprawl around it.
That sprawl is the normal state of security policy today: hundreds of hand-maintained rules per device and per application, edited by different people at different times, drifting apart until nobody can answer a simple question — what is our policy, and is it actually in force?
APE starts from the other end. One policy, stated as intent in plain English. The translation into enforceable rules is consistent and inspectable. Every layer enforces the same intent, and every decision is written to an audit chain whose integrity can be verified mathematically. Policy stops being a pile of device configs and becomes a single, provable statement.
How it works
From a sentence a human can read to a decision a machine can prove, in three steps.
Write the policy in plain English
“Contractors must not access financial records.” “Administrators need MFA for the cardholder data environment.” If a person can state it, APE can start from it — no rule syntax, no per-device dialects.
AI parsing maps it to rules and controls
An LLM parser — a hosted model such as GPT-4o-mini, or a self-hosted Ollama model inside your own network — converts the statement into structured rules and identifies the compliance framework and control it implements. A deterministic fallback parser keeps APE working when no LLM is configured.
Enforcement layers decide; the chain proves it
Enforcement layers evaluate every request against the active rules. Allow or deny, the decision is appended to a hash-linked, blockchain-style audit chain — tamper with a past event and verification fails.
Platform
Everything below is built, running, and reachable from the console and API on this site.
Natural-language policy parsing
Write policies the way you would explain them to a new hire. Choose your parser: a hosted OpenAI-compatible model or self-hosted Ollama, with a deterministic fallback when no LLM is available.
Framework template library
35 curated policy templates — seven each for HIPAA, PCI DSS, GDPR, SOC 2, and NIST CSF — every one tied to a real, citable framework control and ready to use as a starting point.
Multi-layer enforcement
Requests are evaluated at the API layer, and policies are translated into platform-level actions, so the same intent is enforced consistently instead of re-implemented per system.
Safe dry-run platform sync
Platform changes are simulated by default, so you can see exactly what a policy would do before it does it. Real system changes are opt-in and dual-gated behind two explicit settings.
Sandbox-isolated policy testing
Test a policy against sample requests in a Wasm-sandboxed evaluator before activation, so a bad rule is caught in the sandbox — not in production.
Tamper-evident audit chain
Every enforcement decision joins a hash-linked, blockchain-style chain. Integrity verification recomputes the chain and exposes any altered event.
JWT authentication & role-based access
Users, roles, and organizations with permission-gated routes: administrators manage policy, viewers can inspect posture and audit history without write access.
Python SDK & full REST API
Everything the console does is available through a documented REST API (OpenAPI, at /docs) and a Python SDK. Persistent storage runs on PostgreSQL or SQLite.
Frameworks
APE's template library and parser map policies to the controls of five widely used frameworks. Examples of the citations shipped in the library:
HIPAA
§164.312(a)(1) — Access controlUnique user identification, audit controls, and transmission security for electronic protected health information.
PCI DSS
Requirement 7 — Restrict access by business need to knowLeast-privilege access, strong authentication, and logging for the cardholder data environment.
GDPR
Article 32 — Security of processingTechnical and organisational measures for personal data, including encryption in transit and controlled exports.
SOC 2
CC6.1 — Logical access securityLogical access controls that restrict systems and data to authorized users.
NIST CSF
PR.AA — Identity Management, Authentication and Access ControlIdentity and access outcomes from the Cybersecurity Framework's Protect function.
An honest note: templates are implementation starting points mapped to controls — they are not a certification or a guarantee of compliance. Your compliance obligations remain yours; APE helps you state, enforce, and evidence the policies you choose.
This site is the product, running
No slideware: the console and API linked below are served by a live APE instance — the same one reporting its health here, in real time.
Checking live status…
Deploy APE in your own environment
APE is licensed on a self-hosted annual basis: it runs inside your infrastructure, under your control, with your choice of LLM provider — including fully self-hosted parsing. Paid pilot engagements are available so your team can evaluate APE against your real policies first.
Request a pilot