Typed capabilities
Every action has a defined input, operating range, approval policy, and stop condition.
Trust by construction
The agent can act.
Its authority stays narrow.
Power comes from reaching across the hardware stack. Trust comes from making every action bounded, authorized, attributable, and open to challenge.
What makes intervention credible
The process is designed to be challenged.
A reviewer should be able to see what was allowed, what happened, what the system inferred, and where uncertainty remains.
Hard safety bounds
The runtime enforces limits independently of the investigation’s preferred next test.
Immutable experiment history
Actions, parameters, observations, and decisions are append-only and time-linked.
Explicit uncertainty
The case states what remains possible, what is ruled out, and what evidence would change the decision.
Role separation
No one party both controls every action and unilaterally judges the result.
Attested handoffs
Actors, releases, receiving environments, and returned findings remain attributable.
One action boundary
Request, authorize, execute, record, return.
- 01
Request
The case names a capability, scope, and purpose.
- 02
Authorize
The local owner approves action, bounds, and disclosure.
- 03
Execute
The runtime enforces the envelope and automatic stops.
- 04
Record
Parameters and observations join the append-only ledger.
- 05
Return
Only the agreed result and evidence references leave.
Privacy partitions
Shared inference does not require shared internals.
Operator partition
Production context stays local
Raw workloads, broad fleet telemetry, credentials, and unrestricted infrastructure access.
Shared case partition
The minimum evidence travels
Synthetic reproducer, scoped metrics, hashes, conditions, exclusions, and decisions.
Vendor partition
Protected internals stay local
Test implementation, design data, manufacturing records, and proprietary registers.
Common record
Findings are accountable
Signed result, stated confidence, limitations, corrective action, and custody.
When the answer is not clear
The case must say so.
Zenobia does not guess. It reports what remains possible, what has been ruled out, and which next test is most likely to settle the decision with the least risk.
Uncertainty is a product state—not a failure to produce a confident-sounding answer.
A safe hold decision with one named settling test is more useful than a false conclusion.
Continue the investigation
Trust the evidence because you can inspect the process.
Discuss capability bounds, local authority, scoped disclosure, and attested replay.