Application Path Assurance enforce

Can I prove it happened end-to-end?

Enforce all declared intents, and continuously prove every application flow follows its intended path — from A to B, through Y. Encryption proves who the two ends were. It never proves where the packet went between them.

Start the free network audit

SRv6 enforce needs Network Truth underneath lab: Linux 6.8 · 100 sent · 100 counted · 0 at the undeclared segment

0100 from reach to path

The segment list is the declared path.

Classic routing is emergent: the path is observed after the fact, never declared, with no artifact to check against. With the path written into the packet, comparison stops being interpretation and becomes a set operation.

Themis compiles the path policies; your controller applies them; per-segment counters say whether each was executed — including the negative. “No undeclared segment ever ran” is a number that reads zero.

sampled→every packet

segment executions counted, not estimated

5→1

control planes carrying the same decision

39,800→0

tunnels of state for a 200-PE mesh arithmetic, not a vendor claim
One flow, one declared artifact, three stages A declared band across the top drops intent into three stages. On the left, a cluster encapsulates the payload with a segment list. In the middle, the transit fabric executes one instruction per hop with no per-flow state. On the right, the far cluster decapsulates and the payload lands in a tenant routing table. declared route & segment objects · one approved change path · the SID list this flow may use A encapsulate app data + SID list identity at the pod through Y one route for the whole domain 010002000300e000 one instruction per hop · a counter at each · no per-flow state B decapsulate SID spent app data into the tenant table Six instructions fit in the destination address itself. Host-terminated, the encapsulation costs exactly 40 bytes of path MTU. The honest description is that the destination has become a program counter. RFC 8986.

0200 what is unproven, and stamped so

Counters prove segments. Everything above them is stated as what it is.

Segment → jurisdiction is an inference layer.— its limits print in every pack, rather than letting the counter carry the claim.
Router silicon is not yet measured.— counter accuracy on hardware, and path tracing as it matures, are measured on a real fabric first.
Needs Network Truth underneath.— the map, the groups and the approvers are what make a path verdict mean anything. A carrier already running SRv6 traffic engineering walks here from Network Truth directly.

e000 End.DT6 deliver

Start where it is already provable.

The free audit, read-only, on what runs today — you keep the gap list either way.

Start the free network audit Or just email us
Start the free audit — read-only