zilix lets you gate agent actions behind signed policy, require human approval before anything runs,
and keep a tamper-evident record of what happened — real building blocks for teams shipping audited
or regulated codebases.
Policy that can only tighten
A rule has exactly two possible actions: deny, or require human approval. There is no “allow” — so org policy can take permissions away from a developer's agents and can never hand new ones out. Rules match on tool, file path, command, or a per-session spend ceiling. The bundle is signed; edit a rule and the signature stops matching.
Shipped
Pulled, verified, fail-closed
Nothing is pushed onto a developer's machine. Each daemon fetches its own bundle every 60 seconds and checks the signature itself, then installs it as a ceiling above local rules. If a bundle doesn't verify, the machine freezes on the last one it trusted rather than reverting to no rules at all.
Shipped
Tamper-evident audit log
Every logged action is chained by hash to the one before it, with periodic Ed25519 checkpoint signatures. Verification detects an inserted, edited, deleted or reordered record and reports where the chain breaks. The chain head survives rotation and restart. Export is JSONL or CSV.
Shipped
Not certified
No SOC 2, HIPAA, FedRAMP, ISO 27001, or FDA certification exists today. Nothing on this page should be read as a compliance claim — it's a description of shipped mechanisms, not an audited attestation, and no control mapping would make your product compliant on its own.
Tamper-evident ≠ tamper-proof
The checkpoint-signing key lives on the same machine as the log it signs. Local verification alone cannot defeat an attacker who already holds the daemon's privileges — they could rewrite history and re-sign it. Shipping records to an independent, off-box collector is the stronger post-compromise copy; that path exists and is what managed organizations get.
We can't prove who produced a record
The org server validates a record's structure and recomputes its digest, and it will flag a gap, fork, or out-of-order chain. But the current upload contract gives it no producer-bound key to authenticate a checkpoint signature against, so it reports that state as verification-unavailable rather than pretending otherwise. “Hash verified” never means “identity verified”.
Not every runtime can be gated
Claude Code and Codex CLI run through a real pre-execution gate. Gemini CLI has no structured approval gate. Cursor and custom CLIs are detected but session creation stays blocked until their adapters are validated. And a CLI you start yourself outside zilix goes through a PATH shim that is fail-open by default — a dead daemon must never brick your shell — so that session is observed, not governed, unless you flip it to fail-closed.
“Local” means something specific
Your provider credentials never leave the daemon, and your repository contents don't travel through the org endpoint. That is not the same as “no data leaves your machine”, and we won't say that. The model provider you choose receives your prompts, context and tool results. An enrolled organization receives identity and device metadata, published policy state, and the audit and spend records created after enrollment — raw prompts and responses are not audit records. Product telemetry is on by default and can be disabled with ZILIX_TELEMETRY=0.
No PHI handling
Today's redaction catches secret-shaped values — API keys, bearer tokens, credentialed URLs. It does not detect or de-identify protected health information (names, MRNs, diagnoses, addresses). zilix is not intended for processing PHI today.
No SSO
Sign-in is password and passkey based. Federated identity (Okta, Azure AD/Entra) is not shipped. Role-based access is a flat owner/admin/member model — and note that an admin action needs passkey assurance on the session itself, so promoting someone to admin does not retroactively upgrade a session already in flight.
No traceability graph, no legal hold
There is no built-in requirement→work-item→commit→review→evidence linkage, and no retention-hold mechanism. The audit log records what agents did; it doesn't map that back to product requirements or generate signed evidence packages.
Local workspaces only
Execution happens on the developer's machine. Hosted workspaces are a future direction and should not be inferred from the managed-environment or remote-access features. Managed container environments need Docker or Podman and are not supported on Windows.
Cost enforcement needs a meter
A spend ceiling only works if the runtime reports usable cost. Sessions that can't report it are shown as unmetered rather than as zero — but a dollar ceiling deliberately also matches when cost telemetry goes missing, which is the only thing standing between a broken meter and unbounded spend.
Is zilix HIPAA, SOC 2, or FDA compliant?
No, and we won't claim otherwise. What's shipped — tighten-only signed policy, approval gates, a hash-chained audit log — are real building blocks toward auditable development, not a certification, and no tool makes an organization compliant on its own. If your team needs a control mapping or a security questionnaire answered, reach out and we'll tell you plainly what's covered and what isn't.
Can zilix sit between an LLM and clinical or patient data?
No. zilix orchestrates AI coding agents that write and review software — it does not integrate with EHRs, FHIR, or HL7 systems, and it has no PHI-aware scrubbing or clinical decision routing. It governs how code gets written, not what a clinical system does with patient data at runtime.
Where do my code, keys, and audit logs live?
Your source code and agent sessions stay on the machine running the daemon, and provider credentials stay in the daemon's config directory — they are never returned over the wire. The audit log is written locally; managed organizations also get an off-machine copy. Four other paths are real and we'd rather name them than blur them: the model provider you choose receives your prompts, context and tool results; an enrolled organization receives identity and device metadata, published policy state and post-enrollment audit and spend records; the organization endpoint routes remote browser sessions but cannot decrypt them; and product telemetry is on by default until you set ZILIX_TELEMETRY=0.
What happens if the audit log can't be written?
The daemon is designed not to crash if the audit disk is full or unwritable — a write failure is counted rather than silently ignored, and that count is exposed on a health endpoint rather than surfaced as a hard stop. Under an active org ceiling the in-process gate fails closed, so an unreadable policy store blocks rather than waves work through. Making the audit-write failure itself more visible by default is still open work.