Solario Zero Trust Principle
The Solario Governance Harness constrains what agents can do, verifies what they produce, requires human authority at key moments and records every decision.
Governance is not a review added after generation. It binds the Project before execution, controls every state transition and remains active from signed Intent through deployment.
Governance Harness
Policy · deterministic controls · human checkpoints · full audit trail
The factory does not ask an agent to remember how your organisation builds software. Rules are described, inherited by the Project and evaluated as part of the production system.
Organisation-wide architecture rules, approved technical stacks, language-specific ADRs, code quality standards, security expectations and test policies define how the factory may operate.
ARCHITECTURE · STACKS · ADRS · QUALITY · TEST POLICY
Each Project adds its delivery strategy, system boundaries, client practices, acceptance obligations and authorised exceptions. Workloads inherit these controls before execution begins.
BOUNDARIES · OBLIGATIONS · PRACTICES · EXCEPTIONS
Named people retain authority at key lifecycle moments. Product Owners approve Intent; engineering and delivery authorities validate the decisions and outputs that require human judgement.
OWNERS · CHECKPOINTS · APPROVALS · VERDICTS
Generative work may be probabilistic. Whether an artifact satisfies its obligations is not left to agent confidence. Each step passes through explicit controls and authority.
Give agents bounded tools, context, permissions and obligations.
Run work through the Orchestrator and explicit state machine.
Use deterministic controls to test artifacts and declared outcomes.
Require accountable human approval where judgement cannot be delegated.
Retain inputs, decisions, runs, findings, repairs, approvals and verdicts.
Requirements, decisions and approvals do not have to be reconstructed for the next change or audit. They remain connected to the work that caused them and the verdict that released them.
Intent
Business goal, requirement, acceptance basis and Product Owner authority.
Decision
Selected approach, constraints, alternatives, author and applicable policy.
Execution
Models, tools, inputs, findings and repair loops exposed through OpenTelemetry.
Verdict
Deterministic checks, exceptions and human approvals retained with the output.
Your standards. Your perimeter.
Run managed on AWS or inside your environment, including restricted on-premise deployments with local models. The code, documentation and production record remain yours.