Surfaces
Six surfaces, five of them evidenced
CanaryVaults tripwires, CanaryHoneypot hits, CanaryAudit records and CanaryShield blocks land in the hash-sealed evidence log, and CanaryAgent timelines read from it. A Shield block carries a content hash in the unchained format CanaryAudit records used before chaining, and reading your Shield log registers each block in the sealed log, after which the public verifier resolves its hash as a canaryshield record. CanaryRAG is the one surface that does not write there. A trap-fact trigger lives in its own table but carries a content hash in that same unchained format, so you can recompute it from the row yourself; the public verifier has nothing to resolve for it.
01CanaryVaultsDecoy email identities minted per protected email and seeded where credentials leak.open →02CanaryRAGTrap facts that catch AI knowledge bases leaking your content.open →03CanaryShieldA three-layer prompt-injection firewall for your model.open →04CanaryHoneypotDecoy assistants that fingerprint and classify attackers.open →05CanaryAuditTamper-evident, hash-sealed record of agent actions. Starts on Shield.open →06CanaryAgentHeartbeats, skill scans and decoy tools for your agents.open →
Reference