one engine

Audit first. Then identity. Then proof.

Themis does not replace your enforcement points. It reads them, holds them against what you declared, and refuses to widen anything that has not survived traffic it never saw.

It sits above whatever already enforces in your estate, and starts by reading, not writing.

Cilium / eBPF policy mTLS & SPIFFE coverage router & firewall ACLs SRv6 / uSID fabric

01

Audit

Flow against intent, read-only, on what you already run.

02

Locator

The addressing plan and the routes to reach it. Strands nothing.

03

Segment

Least-privilege policy by role — and the path it must take.

04

Verify

Against traffic it never saw. Against the path actually taken.

05

Approve

Enforce only what survived. A person decides the sensitive cases.

Steps 01, 04 and 05 run today on the estate you already have. Steps 02 and 03 are what SRv6 adds: carry the allowed path in the packet and every segment counts what crossed it, so conformance becomes a number instead of an absence of alerts.

See it on your estate Why you can trust a pass →

0100 the engine

What each step actually does.

01 Audit — a three-way compare between declared intent, the configuration in force, and observed traffic. Read-only: configuration is ingested from what is really there — router and firewall ACLs, cluster policy, mesh configuration — and nothing is written back.
02 Locator & route — the addressing plan carves instructions, not labels, and is proposed against the live routing table. The strands-nothing check is a reachability proof, run before anything is written.
03 Segment & path as code — least-privilege policy by role, plus the path it is allowed to take. One write path to the network: every change is a proposal that must pass the same gate. The gate is mechanical, not procedural.
04 Verify — the policy is scored against a held-back set and an adversarial set the drafting stage has no path to. Three witnesses, each used only for what it can prove: counters for execution, probes for reachability, flow records for classification.
05 Approve & retire — nothing risky happens without a name on it. Sensitive flows queue for a named human; approvals and rejections are stamped user · time · event; unused rules are retired only after holding a full observation window.

End to end, once the path is declared

One flow, one declared artifact, three stages A declared band across the top drops intent into three stages. On the left, a cluster encapsulates the payload with a segment list. In the middle, the transit fabric executes one instruction per hop with no per-flow state. On the right, the far cluster decapsulates and the payload lands in a tenant routing table. declared route & segment objects · one approved change path · the SID list this flow may use cluster a encapsulate app data + SID list identity at the pod transit fabric one route for the whole domain 0100 0200 0300 e000 one instruction per hop · no per-flow state cluster b decapsulate SID spent app data into the tenant table Six hops fit in the destination address itself: no added header, no MTU erosion, no hardware header-parsing requirement. The honest description is that the destination has become a program counter. RFC 8986.

0200 deployment

One engine. Two ways into the path.

A · over the Kubernetes control and data plane

No router changes. Transit you don't own.

Policy and verification run over the clusters you already have, across transit you do not own — including a VPC. Identity stays cryptographic: mTLS and SPIFFE, not addresses.

core

B · the full uSID fabric

One route in the core. Per-segment evidence.

The core carries the uSID block as an ordinary prefix and holds no per-flow state. Per-segment counters make path conformance a provable negative rather than an absence of alerts.

SRv6

Verified on stock Linux 6.8: the segment list rides in the packet, per-SID counters are exact, 104 bytes of header avoided. Reproducible in three minutes. Never yet run on an operator estate, or on router silicon.

Both start identically: a read-only audit.

Runs in your tenant

A container on your own infrastructure. Air-gap capable. Raw flows never leave the site.

CPU only, no GPU

No hardware prerequisite lands in a network team's budget. Models are optional and never in the verdict path.

Deterministic verdicts

The same export yields the same gap list every time. Evidence that is not reproducible is not evidence.

Read-only by default

Weeks one and two write nothing. Enforcement is a later, separate, approved decision.

0300 trust surface

What decides, and what merely reports.

The gate engine

Thresholds are versioned in the control plane, not typed into a console. Admission refuses anything that was not proposed through the one write path.

The console

Intent and rule management, gate status, the escalation queue, the retire ledger, and pass or fail per scope and per tenant. It reports; it does not decide.

The named human

Approve and reject are stamped user · time · event. Sensitive flows are never auto-allowed and never silently dropped — they wait.

0400 scale

A verdict engine, not a flow lake.

The usual objection is arithmetic: 100 TB a day of IPFIX arriving, and an evidence claim that depends on all of it. The answer is that the audit never needed the records — it needed the verdict and the exception.

The verdict ledger

Per-class aggregates keyed by role pair, so the ledger grows with O(roles²), not with the number of flows. A busy estate has a few hundred roles and billions of flows; only one of those numbers is in the storage bill.

Per-witness economics

Counters are counters — already in the forwarding hardware. Probes are a dial we own and can turn down. Flow records are classified in flight at the edge and discarded.

Full fidelity, narrowly

Kept only for exceptions and for a declared sample of passes. The exception is the interesting minority; the conforming majority is a number.

A commitment per window

Each discarded window leaves a hash commitment behind, so the ledger is provably a summary of the stream actually seen rather than a story about it. Raw flows never leave the site.

The audit needs the verdict and the exception, not a billion conforming records.

0500 before you ask

What runs on your estate today — and what SRv6 adds.

Two families, and every capability on this site is tagged as one of them. Core runs on the estate you already have, whatever enforces in it. SRv6 is what the fabric adds on top, and it is the half that needs the network to move with you.

Core — on the kit you already run core

The three-way compare between declared intent, configuration in force and observed traffic.

Held-out and adversarial verification, with the drafting stage mechanically unable to read the held-back set.

Policy compiled at L4 and L7, with identity kept cryptographic — mTLS and SPIFFE rather than addresses.

Read-real ingest of router and firewall configuration, and conservative rule retirement that holds a full observation window first.

Day-two drift classification on a live stream, gated on a freshness service level.

SRv6 — what the fabric adds SRv6

The locator and route plan, per-segment path proof, per-SID counters as evidence, and the fabric migration itself — the parts that need SRv6 in the path.

Jurisdiction assurance sits above those counters: they prove which segments executed, and the mapping from segment to jurisdiction is the layer we design with you.

The data path already runs natively on modern Linux — seventeen checks green on a stock 6.8 kernel, reproducible in three minutes, with every boundary documented rather than hidden.

Revenue never waits on SRv6. Core lands on any estate you run today — the fabric is what you grow into, not what you buy first.

what you can buy

Five offers. The first one lands every engagement.

Segmentation audit core — a fixed-scope, read-only engagement on the estate you already run. Three-way compare, who-calls-who map, rule and flow classification, IPv4 ledger. No change window.
Continuous assurance & evidence core — flows scored against declared intent on an ongoing basis, drift watched, escalations queued for a named human, evidence packs produced per scope or per tenant.
Path & jurisdiction assurance SRv6 — proof that traffic took the prescribed path, from per-segment counters. Requires SRv6 in the path.
Fabric simplification & migration plan SRv6 — the locator plan, the routes and segments as code, and one approved write path. Reversible, and it strands nothing.
In-tenant zero-trust fabric SRv6 — host-terminated segments over any IPv6 transit, including one you do not own. One deployment step is explicit rather than discovered: the ingress MTU.

There are no prices on this site, and that is deliberate. Savings are computed from your own estate in the first two read-only weeks — never from our slides. Offers stamped SRv6 are scoped as design-partner phases with published gates, not sold as product.

e000 End.DT6 deliver

See it against your own kit.

30–60 minutes. Read-only. We compare your declared intent to what is actually running, and hand back the gap list.

See it on your estate Or just email us

Nothing is installed to have this conversation.

See it on your estate — read-only