Design-intent reference and simulation. Not a shipped product, not a medical device, no clinical claims.

Docs home | API reference

Demo runbook: 10 minutes with Saqib

Framing line: "This is a design-intent simulation. Fictional devices, real policy code. Nothing here is a shipped product or a clinical claim."

0:00 to 1:00, secgenix.com

  • Hero: authentication answers who; TAL answers whether this device, this initiator, this operation, now.
  • Scroll to the three cases (routine, unexpected, compromised). They mirror the deck.
  • Point at the two form factors and say they are kept distinct: SDK embedded sees commands, network proxy sees traffic patterns and does not decrypt TLS.

    • 1:00 to 2:30, demo.secgenix.com, Normal operations

  • Particles are real decisions from the policy core running in the browser.
  • Right panel: admitted, denied, shaped, receipts; policy v, digest, signer key.
  • Click "Verify chain offline", then "Tamper one and verify". Tampering is detected.

    • 2:30 to 4:00, Unauthorized programmer blocked

  • Unenrolled programmer and a revoked loaner. Feed shows unknown-source and revoked-source. Authorized programmers keep working.

    • 4:00 to 5:00, Known device, wrong initiator

  • Same enrolled programmer, autonomous initiator. no-matching-rule. This is the authorization question from the deck.

    • 5:00 to 6:00, Firmware update gated

  • At 12:00 UTC: outside-window. Click "Jump clock to 02:30 UTC": admitted at 2 per second.

    • 6:00 to 7:30, Telemetry flood shaped

  • Monitor floods at 20x. Shaped count climbs, telemetry queue fills and tail drops, control delivery stays 100 percent.

    • 7:30 to 8:30, Policy push to 1,000 edges

  • Click publish. 1,000 real signature verifications in the browser; 3 tampered copies rejected, 2 offline edges stay on v1 and fail closed at 24 h.
  • Back on Normal operations: "Lose control plane for 25 h" turns everything to policy-expired denials. "Restore and refresh" recovers.

    • 8:30 to 10:00, admin.secgenix.com

  • Sign in screen: passkey first by design; use demo login hb@demo.
  • Tenancy tree (six levels). Policies: as author@demo draft a version; try to approve as the same user (blocked); approve as approver@demo; publish. Event log shows each step. Live flows shows receipts streamed from the demo tab.
  • Close: built versus designed is listed in CAPABILITIES. Patents: US 12,272,455 B2 and US 12,592,317 B2.

    • If something fails

  • Demo runs fully in the browser; it does not need the API. Admin needs api.secgenix.com. Local fallback: npm run cp:local, npm run edge:node, npm run sim -- --scenario rogue-programmer.

    • Live traffic segment (Phase 2)

    1. Sign in at admin.secgenix.com with a passkey (first time: expand Register, enter the bootstrap token from .secrets/prod.json).

    2. Lab tunnels, Mint a gateway token and a device token. Start the gateway and attach a device per ATTACH_GUIDE.md.

    3. On the device, browse through tal connect or the full tunnel. Show allowed web flows appear, then try ssh or a private address and show the deny with its reason.

    4. Open demo.secgenix.com: the Live gateway card shows the same flows redacted to roles. If no gateway is online it says so and the simulator carries the story.

    5. Revoke the device from the console and show its next connection fail.