Regulayer Enterprise licensing
Main site The engine By problem What is licensed Deployment Assurance AI audit trail Human authorship and review The record format What it proves Security review Begin with the problem

FailStop · a Regulayer surface

It acted before anyone could stop it.

FailStop is a fail-closed brake in the action path. Before an action runs it must receive a positive yes. No permission means stop. Silence means stop. It latches, and it stays stopped until a person, not the system, re-arms it.

The situation

Software now takes actions it cannot take back. A payment, a deletion, a send. The window between decision and consequence has closed to nothing, and the only control standing in it is the judgement of the system that is acting.

A brake that lives inside the system it stops is a feature, and features answer to the product. FailStop sits outside, where the governed system has no way to disable it, reconfigure it, or forge its records. Disguised instructions, lookalike characters and slow multi-turn escalation are checked before the decision, not after the damage.

How it behaves

Fail closed

Every action requires a positive yes before it runs. No answer is a no. A lost heartbeat is a no. The default state is stopped.

Latched

Tripped, it stays tripped. Nothing runs again until a person re-arms it. The system under governance cannot re-arm itself.

The halt and its proof, sealed together

Every decision, every stop and every re-arm lands in a sealed, tamper-evident record at the moment it happens. There is no version of events to reconstruct later.

A physical channel, for machines that move

The filed design includes a safety-rated interlock that removes motive power in about a tenth of a second. A robot arm, a vehicle, a production line: the software says stop, and the hardware makes it true.

Where it belongs

AI agents

Software that pays, sends, deletes and signs needs a brake before every irreversible act.

Robots and cobots

Motive power removed on trip, and the stop itself recorded.

Vehicles and drones

A latched stop that the vehicle cannot override, with the record of why it fired.

Production lines

Stop authority outside the control system, in the pattern machinery safety already understands.

Deployment

It runs on your machines, and nothing of the work leaves the building.

The kernel binds the loopback interface and refuses any client that is not local. The signing key is generated on your own machine on first run and never leaves it. In the default mode there is no outbound call of any kind. Where independent time is required, a single cryptographic digest goes to a public timestamp authority, never the file and never its contents. The source ships readable, so your own security function can satisfy itself line by line.

Every answer your security function will ask for, on one page you can forward

The estate

Part of the filed estate: eighteen patent filings and a PCT. Patent pending across the estate.

Licensing begins with the problem, not the product.

Describe the system, what it decides, and what it would cost you to be unable to prove it. A written scope follows before any call.

Ways to begin:

A scoped pilot, inside your estate, on your machines. An architecture briefing, for your security function, one hour. The diligence pack: the record format and the estate, in writing. The problem itself, in your own words.

hello@regulayer.com