Open-weight models come with no vendor standing behind them. Excubitor keeps a registry of the exact weights a named person approved, proves what each model server actually serves, and lets an agent reach a server only while the two match.
{
"type": "posture",
"agent": "excubitor.models",
"payload": {
"decision": "model_attested",
"server": "models.acme.internal",
"model": "acme-assist-70b",
"digest": "sha256:3f9e…a1",
"approved_by": "security lead",
"licence": "recorded"
},
"evidence": {
"chain": "sha256-chain/2",
"prev": "71d0…4b"
}
}
A named person approves specific weights, with licence and source, by the fingerprint of every model file.
Each model server attests the weights it serves. A swapped model is a high alert and its server is refused.
Revoking an approval cuts off every server serving those weights, and a CI step fails a build that ships weights nobody approved.
A model is its files, so approval is by content hash. Renaming a file approves nothing.
The server's attestation is compared with the registry before an agent's request reaches it.
The CI step reads the registry and fails a build carrying unapproved weights, before anything ships.
The registry, attestation and revocation all run inside your estate. Nothing is sent out.
Every item names the release that carries it. Releases are signed, and each lists the commands to check them before you install.
The model registry: fingerprints, approval, attestation, revocation, the CI step and the governance report.
No standing vendor access, ever. Managed with evidence, never on faith.