Secure AI for
Defense and Government
Verify. Secure. Enforce. From supply chain to runtime — across connected, on-premises, and air-gapped environments.
Jozu has achieved Awardable status on both the CDAO Tradewinds Solutions Marketplace and the Platform One Solution Marketplace — ensuring our solution has met rigorous qualification measures and is ready for rapid acquisition by DoD and federal customers.
The Agentic AI Governance Gap
The shift from generative AI to agentic AI changes the risk calculus. Models take inputs and produce outputs. Agents take actions — they invoke tools, access data, interact with systems, make decisions, and spend money on behalf of users. Traditional security controls weren't built for autonomous, non-deterministic actors operating at machine speed.
As the ATARC DevSecOps Working Group frames it, organizations are transitioning from "Creator" to "Curator" — moving from writing every line of code to orchestrating squads of autonomous agents. This paradigm shift demands a new defensive architecture grounded in Zero-Trust for machine autonomy.
Ungoverned Agent Sprawl
Agents and MCP servers proliferating across desktops, IDEs, and production environments with no centralized visibility, inventory, or policy enforcement.
Supply Chain Blind Spots
Models, agents, and MCP servers carry threats traditional container scanners miss — serialization attacks, data poisoning, backdoored weights, adversarial susceptibility, and prompt injection.
Runtime Actions Without Guardrails
IAM verifies authorization but cannot verify the agent binary matches what was approved. DLP has no primitives for governing tool invocations, decision chains, or autonomous spending.
Air-Gapped and DDIL Requirements
Governance architectures that depend on a central control plane must choose between failing open (security gap) or failing closed (outage) when connectivity is lost.
Supply Chain Verification Before Runtime. Policy Enforcement During Runtime.
Most governance tools start at runtime. By then, you're already trusting that the agent, model, or MCP server running is what you approved. Jozu starts earlier, in the development phase, and remains through execution.
Verify Before Execution
Every AI artifact is packaged as an OCI-compliant ModelKit, scanned by five integrated security scanners covering 10+ vulnerability types, and protected by cryptographic signatures and signed attestations. ArtifactPolicy evaluates scan results, signatures, and provenance before any artifact is approved for deployment.
Enforce Before Execution
Agents execute inside a protected runtime (micro-VM or Kata container isolation) where every action is policy-governed. ToolPolicy enforces per-tool, per-agent, per-user access controls at every invocation. GuardrailPolicy inspects prompt content and tool arguments at the semantic level. Human-in-the-loop gates high-risk actions.
Audit Everything
Every policy decision — every admission check, every tool invocation approval or denial, every guardrail evaluation — is logged in a tamper-evident, cryptographically chained audit trail. Logs operate autonomously when disconnected and sync when connectivity is restored.
AI-Specific Security Scanning
Five integrated scanners (ModelScan, LLM Guard, Garak, Promptfoo, ART) assess 10+ vulnerability types including serialization attacks, data poisoning, backdoored weights, adversarial susceptibility, and prompt injection. Scan results are attached as signed attestations on the artifact itself.
Content-Aware Enforcement
Agent Guard doesn't just see where agents connect — it sees what they say and do. Semantic-level inspection of prompt content, completion content, and tool arguments detects threats that infrastructure-level controls (network rules, filesystem access, syscalls) cannot distinguish.
Built for Defense and Government Environments
Designed to operate in the most secure and challenging environments
-
Air-Gapped and DDIL Operations
Self-verifying artifacts. No external dependencies.Policies are distributed as versioned, cryptographically signed OCI artifacts. Policy integrity is verifiable locally without a network call. Agent Guard enforces policy on servers, desktops, edge devices, and air-gapped networks. Self-verifying artifacts carry everything needed to confirm provenance — no external verification service required.
-
Integrates with Your Stack
Open standards. No proprietary formats.ModelKits are OCI artifacts that work with any container registry and Kubernetes cluster. No proprietary formats. No new infrastructure. Same registries, same deployment pipelines, same vulnerability management workflows your teams already operate.
-
Kubernetes-Native
Deploy anywhere. No Docker prerequisite.Jozu Hub deploys on customer infrastructure via Helm. Agent Guard runs as a single binary — server, desktop, edge, IoT. Native support for Kata containers and micro-VM isolation. No Docker prerequisite for Agent Guard.
Zero-Trust for Machine Autonomy
The ATARC DevSecOps Working Group and NIST's Concept Paper on AI Agent Identity both frame agents as Non-Person Entities (NPEs) — high-privilege actors that require governance controls beyond what IAM provides. Jozu operationalizes this framework.
Non-Person Entity Governance
ArtifactPolicy verifies the provenance and integrity of every agent before it loads into the runtime. ToolPolicy re-evaluates permissions at every tool invocation — not just at session start — limiting inherited privilege abuse across delegation chains.
Zones of Intent Scaffolding
Agent Guard's protected runtime physically bounds autonomous reasoning within designated boundaries using micro-VM or Kata container isolation. If an agent is compromised, blast radius is contained.
Reversible Resilience
ToolPolicy triggers human-in-the-loop elicitation for high-risk actions. Approvals are signed attestations. Every action is logged in a tamper-evident audit trail that supports forensic review and rollback traceability.
Fail Closed by Design
Agent Guard denies on missing data or evaluation errors. This is the default behavior, not a configuration option. Architectures that delegate failure behavior to the developer default to fail-open, creating silent security gaps.
How Jozu Maps to the OWASP Agentic AI Top 10
The OWASP Agentic AI Top 10 identifies the critical security risks facing autonomous AI systems. Here is how Jozu addresses each one.
What Tradewinds Evaluators
Recognized
Jozu enables secure packaging, cryptographic signing, automated AI-powered security scanning, supply-chain verification, and policy-enforced deployment, helping ensure that AI agents and models are built securely, tamper-proof when deployed, and easy to audit for mission-critical environments.
“The assessment highlighted:
-
Precise problem articulationOf defense AI challenges
-
Standardized OCI-compliant ModelKitsWith tamper-evident provenance
-
Simple subscription modelWell-aligned to secure, multi-cluster DoD deployments
-
Air-gapped environment supportFor disconnected operations
Governance That Scales With Your AI Maturity
| Maturity Stage | Your Challenge | Jozu's Role |
|---|---|---|
| Ad-Hoc (The Researcher) |
Shadow AI proliferating with no visibility or controls | Jozu Hub provides centralized inventory. MCP Registry API gives IDE users a curated, security-scanned source for AI tools. |
| Human-Centric (The Creator) |
AI-assisted coding with no artifact integrity verification | Jozu Hub scans model artifacts and dependencies. SPDX 3 SBOMs track provenance and training lineage. |
| AI-Assisted (The Pilot) |
AI integrated into CI/CD with no policy gates on AI-generated artifacts | ArtifactPolicy gates promotion. ToolPolicy enforces strict API contracts that fence probabilistic AI behavior. |
| AI-Agentic (The Curator) |
Autonomous agents with tool access performing multi-step workflows | Full platform: Agent Guard enforces ToolPolicy and GuardrailPolicy at every invocation. Human-in-the-loop for high-risk actions. Tamper-evident audit logs. |
Frequently Asked Questions
How does Jozu support our compliance posture?
Jozu provides the technical controls that support your compliance posture. Jozu does not claim certification — Jozu enables compliance.
OMB M-25-21 (Accelerating Federal AI)
Centralized inventory, policy administration, and audit infrastructure for mission-aligned AI scaling.
OMB M-25-22 (AI Acquisition Standards)
Pre-award testing via five-scanner pipeline and ArtifactPolicy gates. Artifact integrity verification protects government data rights.
NIST Cyber AI Profile (IR 8596)
Addresses AI-specific threats (data poisoning, model exfiltration) through supply chain scanning, signed attestations, and runtime policy enforcement. Integrates CSF 2.0 with AI RMF.
NIST AI RMF
Govern (policy administration, registry, audit) · Map (scanning, SBOMs, ArtifactPolicy) · Measure (tamper-evident chained logs) · Manage (ToolPolicy, GuardrailPolicy, human-in-the-loop, fail-closed).
NIST SP 800-53
Supply chain (SR-3/4/9/11) · Audit (AU-2/3/9/10/12) · Access control (AC-3/4/6) · Configuration management (CM-3/7/14) · Supply chain risk (SA-12) · Cryptographic identity (IA-3).
CMMC Level 2/3 · SWFT · SPDX 3
Tamper-evident audit logs, disconnected operation, supply chain scanning, SBOM generation with training lineage and license compliance. Supports SWFT, EO 14028, and FedRAMP requirements.
How is Jozu procured by Government and Defense organizations?
Tradewinds Awardable
CDAO, awarded February 2026. Primary DoD procurement entry point.
Platform One Solution Marketplace
Awardable status achieved April 2026. Jozu provides the "AI Iron Bank" layer for AI models, agents, and MCP servers — OCI-compliant ModelKits with model-specific scanning, signed attestations, and air-gapped enforcement.
FedRAMP 20x
In progress.
Capabilities Statement:
UEI: TU95BNULRWD5 · CAGE: 11YB0 · NAICS: 513210
Contact: [email protected]
What other regulated industries does Jozu support?
Healthcare (HIPAA, FDA, 21 CFR Part 11)
ToolPolicy governs which agents access patient data. GuardrailPolicy detects PII and PHI in prompts and completions. Tamper-evident audit trails provide cryptographic record integrity for GxP compliance.
Financial Services (SOX, Basel, SR 11-7)
Tamper-evident versioning and artifact diffing support model risk management. ArtifactPolicy promotion gates enforce validation before production deployment. Audit trails provide non-repudiation for regulatory examination.
CUI-Handling Organizations
Air-gapped operation and local policy enforcement ensure Controlled Unclassified Information never leaves the designated security boundary — even when agents perform autonomous actions.
What organizations have adopted Jozu/KitOps?
Jozu and KitOps have been adopted by organizations that require the highest levels of security and compliance.
U.S. Government & Defense
Active engagements with DoD, federal civilian agencies, and national laboratories.
European Government
Adopted by government organizations requiring on-premises governance and compliance with EU frameworks.
Global Regulated Enterprise
Healthcare, financial services, and organizations handling CUI — wherever AI governance, supply chain verification, and audit trails are required.