Start trial

Instance Trust Fabric

The Trust Fabric lets AthenaDB instances authenticate each other, negotiate scoped capabilities, and exchange permission-filtered context — never raw remote SQL. See the Trust Fabric product page for the overview.

Core model

  • Cryptographic identity — every instance has an Ed25519 identity; trust is never based on hostname or network.
  • Trust is a policy object — directional, non-transitive by default, time-bounded, and revocable.
  • Structured requests only — instances speak in typed requests (context pack, memory, embedding, sync, graph, timeline, task delegation), never arbitrary SQL.
  • Filtered context — a remote returns permission-filtered context packs (excerpts, citations, provenance, confidence), not table access. RBAC grants the role; ABAC gates each request; deny-by-default.
  • Encrypted + audited — channels are mutually authenticated and encrypted (mTLS); every allow/deny is appended to a hash-chained, SIEM-exportable audit on both sides.

Try it from the CLI

athenadb db trust enroll <instance>
athenadb db trust create <instance> --role rag
athenadb db trust simulate <instance> <request>   # dry-run before enabling
athenadb db trust graph

Availability

The Trust Fabric is a premium capability (Enterprise, plus Trial for evaluation). Sentinel monitoring is advisory today; blocking enforcement is a later phase.