Every connection.
Explicitly authorized.
Authentication tells you who is connecting. SecGenix answers the harder question: should this device, started by this initiator, perform this operation, right now, in this scope. Anything not explicitly allowed is denied, and care continues.
Authentication is answered.
Authorization is not.
Routine session
An enrolled programmer, a clinician initiator, an approved operation. Allowed, shaped to its policy rate, and receipted.
Unexpected request
A valid device asks at an unexpected time, or the request is started by an autonomous process. Credentials pass. Authorization does not. Denied, and therapy is untouched.
Compromised endpoint
An endpoint that is on the allowlist can still only do what its rules permit, at the rate they permit. Its reach is limited to authorized scope.
Long-lived devices are patched on intervals measured in months or years. TAL is designed to narrow the window between a new weakness and its fix, from outside the implant, without changing firmware or therapy.
A pure decision, a signed policy, a receipt for every flow.
Identity
Every device is enumerated with a role, owner tenant and revocation state. Unknown means denied.
Context
Rules bind role, operation, traffic class, initiator and time window. Firmware moves only inside an approved window.
Shaping
Allowed flows are rate limited per flow and queued by strict priority. Control traffic always goes first.
Proof
Each decision yields an Ed25519 signed, hash-chained receipt that a third party can verify offline and replay.
Preservation-First
A denial fails safe. TAL never alters implant firmware or therapy, so blocking a request does not stop care.
Deny by default
Default-deny allowlists, local policy at the edge, refresh about every 5 minutes, hard expiry at about 24 hours, then fail closed.
Workflow aware
Policies follow clinical workflow: who initiated, which operation, which unit, which window.
One policy model, across device classes.
Two form factors, kept distinct because they see different things.
SDK embedded
Linked into the device or app software. Sees each command directly, so it can authorize at the level of individual operations.
Network proxy
Sits in the path in front of a device. Detects and shapes by traffic pattern, flow metadata and identity. TLS is not decrypted.
Standalone, or alongside what is already there.
Sidecar
Next to an existing service, intercepting its flows without code changes.
Container
A small distroless image for ECS, Fargate, Kubernetes or an edge appliance.
VM
A hardened virtual appliance in a facility network segment.
Host OS
A host agent on gateways and workstations that already run in the clinic.
Control plane
Six levels of tenancy: platform, partner or OEM, health system, facility, unit, device group. Role based access with separation of duties, versioned signed policy dissemination, and an append-only event log. Runs on Cloudflare Workers today, with portable adapters for AWS.
Built on granted patents.
US 12,272,455 B2
Granted April 2025.
US 12,592,317 B2
Granted March 2026.
Priority date February 17, 2021.
See it decide.
A live simulation running the actual SecGenix policy core in your browser.