For the engineer who wants the mechanism

A verification layer above whatever already enforces.

Themis does not replace your enforcement points. It reads them, holds them against what you declared, and refuses to widen anything that has not survived traffic it never saw.

Book 30 minutes or read on — this page is the long answer

0100 the engine

Five steps, each independently useful.

01 Audit — a three-way compare between declared intent, the configuration in force, and observed traffic. Read-only: configuration is ingested from what is really there — router and firewall ACLs, cluster policy, mesh configuration — and nothing is written back.
02 Locator & route — the addressing plan carves instructions, not labels, and is proposed against the live routing table. The strands-nothing check is a reachability proof, run before anything is written.
03 Segment & path as code — least-privilege policy by role, plus the path it is allowed to take. One write path to the network: every change is a proposal that must pass the same gate. The gate is mechanical, not procedural.
04 Verify — the policy is scored against a held-back set and an adversarial set the drafting stage has no path to. Three witnesses, each used only for what it can prove: counters for execution, probes for reachability, flow records for classification.
05 Approve & retire — nothing risky happens without a name on it. Sensitive flows queue for a named human; approvals and rejections are stamped user · time · event; unused rules are retired only after holding a full observation window.

End to end, once the path is declared

One flow, one declared artifact, three stages A declared band across the top drops intent into three stages. On the left, a cluster encapsulates the payload with a segment list. In the middle, the transit fabric executes one instruction per hop with no per-flow state. On the right, the far cluster decapsulates and the payload lands in a tenant routing table. declared route & segment objects · one approved change path · the SID list this flow may use cluster a encapsulate app data + SID list identity at the pod transit fabric one route for the whole domain 0100 0200 0300 e000 one instruction per hop · no per-flow state cluster b decapsulate SID spent app data into the tenant table Six hops fit in the destination address itself: no added header, no MTU erosion, no hardware header-parsing requirement. The honest description is that the destination has become a program counter. RFC 8986.

0200 deployment

One engine. Two ways into the path.

A · over the Kubernetes control and data plane

No router changes. Any IPv6 transit.

Policy and verification run over the clusters you already have, across transit you do not own — including a VPC. Identity stays cryptographic: mTLS and SPIFFE, not addresses.

B · the full uSID fabric

One route in the core. Per-segment evidence.

The core carries the uSID block as an ordinary prefix and holds no per-flow state. Per-segment counters make path conformance a provable negative rather than an absence of alerts.

Both start identically: a read-only audit.

0300 trust surface

What decides, and what merely reports.

The gate engine

Thresholds are versioned in the control plane, not typed into a console. Admission refuses anything that was not proposed through the one write path.

The console

Intent and rule management, gate status, the escalation queue, the retire ledger, and pass or fail per scope and per tenant. It reports; it does not decide.

The named human

Approve and reject are stamped user · time · event. Sensitive flows are never auto-allowed and never silently dropped — they wait.

0400 scale

A verdict engine, not a flow lake.

The usual objection is arithmetic: 100 TB a day of IPFIX arriving, and an evidence claim that depends on all of it. The answer is that the audit never needed the records — it needed the verdict and the exception.

The verdict ledger

Per-class aggregates keyed by role pair, so the ledger grows with O(roles²), not with the number of flows. A busy estate has a few hundred roles and billions of flows; only one of those numbers is in the storage bill.

Per-witness economics

Counters are counters — already in the forwarding hardware. Probes are a dial we own and can turn down. Flow records are classified in flight at the edge and discarded.

Full fidelity, narrowly

Kept only for exceptions and for a declared sample of passes. The exception is the interesting minority; the conforming majority is a number.

A commitment per window

Each discarded window leaves a hash commitment behind, so the ledger is provably a summary of the stream actually seen rather than a story about it. Raw flows never leave the site.

The audit needs the verdict and the exception, not a billion conforming records.

0500 limits

What this does not do.

Segmentation reduces blast radius. It does not erase it. — L3/L4 and L7 segmentation constrains what an attacker can reach along allowed paths. On an allowed path, a compromised workload is still a compromised workload.
An address you can read is one anyone can spoof. — identity stays cryptographic. Addresses carry the path and the instruction; they are never the authentication.
IAM keeps the cloud API plane. — we retire its network-shaped hacks, not IAM itself. The boundary is stated rather than blurred.
Current figures are lab figures. — measured on controlled topologies and labelled as such. Your numbers come from your estate, in the first two read-only weeks.

e000 End.DT6 deliver

See it against your own kit.

30–60 minutes. Read-only. We compare your declared intent to what is actually running, and hand back the gap list.

Book 30 minutes hello@th6mis.ai

Nothing is installed to have this conversation.

Book 30 minutes — read-only