How Mnemom earns the trust we're asking you to give.

Inbound message screening — every prompt and tool result reaching your agent is evaluated for prompt injection, social engineering, indirect injection, and tool-call coercion. Verdict signed Ed25519.

Agent Integrity Protocol evaluates the agent's thinking against its Alignment Card on every turn. Drift, value misalignment, and boundary violations surface in the signed decision trace.

Agent Alignment Protocol records AP-Traces post-hoc and verifies behavioral consistency against the card. The audit chain links AIP checkpoints to AAP traces by `linked_trace_id`.

Outbound response screening — every agent reply is evaluated against PII, secrets, alignment-card violations, and regulated-advice patterns before it leaves your perimeter. An unredacted leak cannot produce a valid signed certificate.

In scope (prevented by design)

• Boundary violations — actions outside the agent's declared Alignment Card.
• Prompt injection + indirect injection — adversarial inbound content.
• Outbound data leakage — PII, secrets, alignment-card violations.
• Behavioral drift — gradual deviation from the agent's baseline.
• Verdict fabrication — the proof layer detects tampered or fabricated verdicts.
• Cross-tenant data leakage — strict tenant boundaries on prompts, traces, alignment cards.

Out of scope (honest disclosure)

• –
  LLM inference correctness — we prove the auditor's judgment, not the model's output.
• –
  Sophisticated steganographic reasoning — agents that reason invisibly evade thinking-block analysis.
• –
  Compromise of the underlying LLM provider's infrastructure.
• –
  Physical / supply-chain attacks against the customer's deployment.
• –
  Denial-of-service against Mnemom infrastructure (mitigated, not eliminated).

In scope

• Gateway (gateway.mnemom.ai) — request signing, front-door inbound screening, attestation pipeline.
• Observer + post-hoc analysis (api.mnemom.ai/v1/analyze) — verdict derivation, back-door outbound screening.
• Control plane (api.mnemom.ai) — auth, billing, containment, audit logs.
• SDKs (@mnemom/agent-alignment-protocol, @mnemom/agent-integrity-protocol) — verification logic, ZK proof verification.
• On-chain contracts (MnemoReputationRegistry, MnemoMerkleAnchor on Base L2).
• Marketing surfaces (mnemom.ai, app.mnemom.ai) — authentication, session management, RBAC.

Out of scope

• –
  Rate-limiting and denial-of-service (mitigated by Cloudflare; not a bounty target).
• –
  Social engineering against employees.
• –
  Physical attacks against infrastructure.
• –
  Third-party services we depend on (Cloudflare, Supabase, Stripe, Resend, Anthropic, OpenAI). Report directly to the vendor.
• –
  Reports requiring access to a victim's email, device, or social account.

Data governance for high-risk AI

Append-only governance event chain — every recipe promotion, retirement, mode change, and reviewer action is Ed25519-signed and chained. Writer-identity stamping isolates arena, customer, and operator signal sources at the schema level.

Record-keeping and traceability

Signed audit chain across the lifecycle — promotion signature, KV envelope signature, R2 envelope signature on independent keys, per-gateway evaluation rows stamped with substrate fingerprint and writer identity. Records are queryable, replayable, and tamper-evident.

Technical documentation

Public advisory CMS at /trust/advisories with signed post-incident write-ups, machine-readable IoC feed at /v1/trust/iocs (STIX 2.1), and published SLOs at /trust/slos. The technical documentation auditors look for is the same documentation customers and agents read.