CAIN PolicyForge, explained for beginners

PolicyForge writes access policies from what agents do, and flags any that would grant more than the approved baseline.

What it is

Writing access policies by hand is slow. PolicyForge writes a least-privilege Rego policy from observed actions.

It then compares the result with the approved baseline. Within the baseline: monotonic_tightening_verified = true. If the observed actions would widen permission (say, delete on prod-db when the baseline is read on reports), the flag is false.

An everyday comparison

An assistant who drafts the access list and puts a red sticker on anything that gives more access than before.

How it works, in 4 steps

1. Send the agent's observed actions and its approved baseline.
2. A Rego policy is written.
3. It is compared with the baseline.
4. Any widening is flagged.

Try it now

Open the two live demo tools → Every button sends a real request to the live product and shows the real answer.

See it on the homepage: CAIN PolicyForge section →

Who it is for

Teams using OPA/Rego to control agents.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.