The context layer for ICME PreFlight
ICME's proxy intercepts the action and the solver returns a cryptographic verdict. Avistar is the context layer — we scan the environment on a regular cadence and maintain an identity knowledge graph of scopes held, blast radius, least-privilege status and compliance posture, which ICME queries at decision time. No real-time mapping. No request-path proxy. No enforcement. Just context.
ICME proxies the action. Avistar supplies the facts.
- 01—ICME proxy intercept (PEP)icmeicme-proxy · parse intent · hold action
- 02—Avistar contextavistarknowledge-graph lookup · scopes · blast radius
- 03—ICME solver (PDP)icmeSMT-LIB · check predicates against facts
- 04—Jolt Atlas prooficmeNovaNet zkVM · receipt over verdict
- 05—ICME proxy release / block (PEP)icmeaction proceeds · or blocked at the wire
- pendingstripe:refunds.write ≤ $5kicme · runtimeAmount $84.20 — runtime parameter only the proxy sees
- pendingowns(charge)icme · runtimeApplication fact: charge belongs to billing-agent tenant
- pendingPCI 7.1 — least privilegeavistar · contextAvistar identity scan: scoped to own merchant
- pendingSOC 2 CC6.1 — logical accessavistar · contextAvistar posture: MFA + role chain verified
- Avistar · least-privilegepending
- SOC 2 CC6.1pending
- PCI 7.1pending
- NIST 800-53 AC-6pending
- CIS Controls v8 · 6.8pending
Avistar is the context layer. ICME owns the proxy and the proof.
Access control decomposes into three standard roles. ICME ships the proxy that intercepts the action and the solver that proves the verdict. Avistar is the context layer — the one piece ICME can't produce on its own: ground-truth identity, reachability and posture, scanned on a regular cadence and stored as an identity knowledge graph ICME queries at decision time. We don't do real-time environment mapping, and we are not in the request path.
agent.prompt("…")
│
▼
┌─────────────────────────────┐
│ ICME proxy (PEP) │ intercepts · holds action
│ in customer infra │
└──────────────┬──────────────┘
│ needs facts about principal P
▼
┌─────────────────────────────┐
│ Avistar identity graph │ knowledge-graph lookup
│ scopes · blast radius │ populated by cadenced scans
│ least-privilege · controls │ (iam:SimulatePrincipalPolicy,
│ │ read-only, outbound-only)
└──────────────┬──────────────┘
▲ refreshed on cadence by avistar.scanner
│ typed facts {scopes, reachability, …}
▼
┌─────────────────────────────┐
│ ICME solver (PDP) │ SMT-LIB · SAT/UNSAT
│ Jolt Atlas zkVM receipt │ proof over verdict + facts
└──────────────┬──────────────┘
│ verdict + proof
▼
ICME proxy releases ✓ or blocks at the wire ✗Intercepts the agent's intended action, holds it, releases or blocks based on the verdict. Sees runtime parameters (amount, target, beneficiary) the knowledge graph cannot.
Plain-English policy compiled to SMT-LIB. Returns SAT / UNSAT / UNKNOWN with a Jolt Atlas receipt that verifies without revealing the policy.
Effective permissions, scopes held, blast radius, least-privilege status, bound compliance controls — scanned on a regular cadence and stored as a typed graph ICME queries per decision. Not real-time mapping, not in the request path.
| Control requirement | Supplier | How |
|---|---|---|
| Principal holds stripe:refunds.write | Avistar | Identity scan: effective permissions |
| Action amount ≤ $5k | ICME · runtime | Runtime parameter visible only at the proxy |
| owns(charge ch_…) | ICME · runtime | Application fact at request time |
| PCI 7.1, SOC 2 CC6.1 (least privilege) | Avistar | Identity posture + compliance tagging |
Avistar ships as a package the ICME proxy embeds. Single in-infra component carries the scoped read-only IAM role. Lowest onboarding friction.
Small container next to the ICME proxy with its own purpose-provisioned, read-only IAM role. Outbound-only, no inbound network surface.
Today's Avistar model. Customer provisions a trust role, Avistar scans from its own cloud. Best for direct Avistar customers; not the ICME-partner case.