# Core Concepts {#core-concepts}

### Agent Identity

Agents are identities you register in Cyphrex. Each agent has a unique ID and optional name. All checks are attributed to an agent so you can enforce policies and track usage per agent.

### Blockchain SSN {#blockchain-ssn}

Every agent can optionally receive a **blockchain Social Security Number** — a cryptographically verified on-chain identity on Solana. It anchors your agent for enterprises that need proof of registration and auditability, not just logs.

- **Immutable identity** — A program-derived address (PDA) acts as the agent's permanent SSN on-chain.
- **Cryptographic verification** — Buyers and auditors can verify identity and registration status (see `GET /v1/verify/:ssn`).
- **Self-custody model**
  - **Self-custody** — You own the identity on all plans. Cyphrex never holds private keys.
  - **Gas policy:** Gas is covered for every agent.
- **Action attribution** — Cyphrex ties checks and audit events to the on-chain identity. Heavier on-chain aggregation can be Merkle-batched over time for cost efficiency where applicable.

**Blockchain SSN is optional.** All monitoring, enforcement, audit log, and alert features work without it. Use it when you need cryptographic audit trails, enterprise verification, and a clear identity layer for autonomous systems.

### Behavior Profiles

Behavior profiles define what an agent is allowed to do: which URLs it can call, which action types are permitted, rate limits, and spend caps. You attach a profile to an agent when registering or updating it.

### Safety Packages

Pre-built profiles for common use cases:

- **Finance** — Restricted URLs, high audit retention
- **Healthcare** — PHI-safe defaults, strict access
- **Support** — Ticket systems, knowledge bases
- **Research** — Academic APIs, read-heavy
- **Code** — Repos, CI/CD, no production writes by default
- **Custom** — Define your own rules

### Action Types

Every check includes an action type. Supported types include:

- `http_call` — Outbound HTTP/API requests
- `llm_response` — LLM completions
- `db_query` — Database queries
- `file_access` — File read/write
- `tool_use` — Tool or function calls
- Custom types for your framework

### Audit Logs

Cyphrex records each check: agent, action type, URL (if applicable), result (allowed or blocked), violations, spend, and timestamp. Retention is 30 days from each event on the free trial. Paid and design-partner accounts choose 1, 3, or 7 years.

### Alerts

Alerts are triggered when violations occur or thresholds are exceeded. Severity levels: **P1** (critical), **P2** (warning), **P3** (info). Delivery via email and/or webhook. View violations under **Alerts**. Configure destinations under **Settings → Alert notifications**.

### Signed Compliance Reports

Every compliance report exported from Cyphrex is hashed with SHA-256 over RFC 8785 JSON Canonicalization Scheme (JCS) bytes, Ed25519 signed by `cyphrex-signer-prod-01`, and independently verifiable against the public key PEM at [cyphrex.io/api/keys/cyphrex-signer-prod-01](https://cyphrex.io/api/keys/cyphrex-signer-prod-01) (text/plain). The HTML registry page is [cyphrex.io/keys/cyphrex-signer-prod-01](https://cyphrex.io/keys/cyphrex-signer-prod-01).

Supported frameworks: **SOC 2 (TSC 2017)**, **EU AI Act (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744)**, **HIPAA**, **SR 11-7 (superseded by SR 26-2, April 2026)**, **SR 26-2**, **NYDFS Part 500**, **Cal. Civ. Code § 1714.46 (AB 316, Stats. 2025, ch. 672)**, **ABA Model Rules 1.1/1.6/5.1/5.3 (Formal Opinion 512)**, **Court AI Disclosure (22 NYCRR Part 161; FRCP 11(b))**, **eDiscovery TAR (FRCP 26 and 34; Sedona Principles 2 and 6)**, **ISO 42001**, **HHS OCR Phase 3**, **EU AI Act Annex III**, **FINRA Rule 4511**, **SOX 302 and 906**, **AML and FinCEN**, **NAIC Model Bulletin**, **NAIC examination handbooks (2025)**, **EU Solvency II (Directive 2009/138/EC)**, **UK FCA operational resilience (PS21/3, SYSC 15A)**, **Colorado ADMT Law (SB 26-189, effective 1 January 2027)**, **HIPAA BAA evidence (45 CFR § 164.502(e) and § 164.504(e))**, **CMS-0057-F prior authorization**, **HIPAA Security Rule NPRM (6 January 2025, not a final rule)**, **SEC Rule 17a-4**, **OCC Bulletin 2023-17**, **U.S. Treasury FS AI RMF (voluntary, 19 February 2026)**, **DORA (Regulation (EU) 2022/2554)**, **PCAOB AS 1105 and AS 1215**. The cyber insurance agent registry is underwriter evidence and asserts no legal requirement. Each agent action maps to a cited control, article, or standard with a status of **Satisfied**, **Prevented**, or **Gap, review required**. Mapping is not certification.

The free trial ends with a day-14 risk report. Signed compliance reports are included on paid and design-partner accounts. Reports are downloadable as PDF or JSON from the dashboard (**Reports**) or via the export API endpoint.

### Vertical Compliance Reports {#vertical-compliance-reports}

Compliance reports are scoped to your industry vertical, selected during onboarding.

- **Legal**: ABA Model Rules 1.1, 1.6, 5.1, 5.3 with Formal Opinion 512 (2024). Court AI Disclosure under 22 NYCRR Part 161 and FRCP 11(b). eDiscovery TAR under FRCP 26 and 34 and Sedona Principles 2 and 6. Cal. Civ. Code § 1714.46 (AB 316). ISO 42001 control mapping.
- **Healthcare**: HIPAA PHI access documentation. HHS OCR audit-ready risk assessment packages. Business associate agreement evidence under 45 CFR § 164.502(e) and § 164.504(e). The evidence record is not the contract. CMS-0057-F prior authorization decision audit trails: decision timeframes and a specific denial reason have compliance dates beginning 1 January 2026, and the Prior Authorization API begins 1 January 2027. The rule does not apply to drugs. HIPAA Security Rule NPRM of 6 January 2025 (90 FR 898): proposed encryption, MFA, real-time monitoring, and removal of addressable versus required. That NPRM is not a final rule. EU AI Act Annex III high-risk system documentation from 2 December 2027.
- **Finance**: SR 26-2 superseded SR 11-7 in April 2026; both remain mapped. FINRA Rule 4511 auditable records. SOX 302 and 906 financial close audit trails. NYDFS Part 500 compliance reports. AML and FinCEN decision audit trails. SEC Rule 17a-4(f)(2)(i)(A) audit-trail records (effective 3 January 2023; mapping is not a finding that every condition of Rule 17a-4(f) is met). OCC Bulletin 2023-17 call-chain documentation (interagency guidance, not a binding law). U.S. Treasury FS AI RMF function mapping (voluntary reference released 19 February 2026, not a regulation). DORA, Regulation (EU) 2022/2554, applicable from 17 January 2025. PCAOB AS 1105 and AS 1215 audit-evidence documentation (technology-assisted analysis amendments apply to fiscal years beginning on or after 15 December 2025; not an audit opinion).
- **Insurance**: NAIC Model Bulletin per-agent underwriting documentation. The NAIC adoption map of 8 October 2026 lists 27 states, DC, and Puerto Rico; a bulletin is guidance, not legislation. State examination documentation under the 2025 Market Regulation Handbook and Financial Condition Examiners Handbook, which are examination methodology and not a uniform statute. EU Solvency II, Directive 2009/138/EC Articles 41, 44(2)(e) and 49; Directive (EU) 2025/2 applies from 30 January 2027. UK FCA PS21/3 and SYSC 15A, with the 31 March 2025 transition ended. Colorado ADMT Law (SB 26-189, effective 1 January 2027). NYDFS Part 500. Cyber insurance agent registry for underwriters, with no legal requirement asserted.

Select your industry during onboarding to unlock vertical-specific reports in the dashboard.

### Merkle Anchoring

Daily anchoring is included on paid accounts. Hourly, every 5 minutes, and real-time are options. Each batch hashes a closed leaf per event into a Merkle tree and writes the root on-chain, giving you:

- A Merkle root of that hour's leaf set, on chain
- Per-event proof of inclusion in that on-chain root

An inclusion proof shows a closed leaf was in the tree whose root was anchored. It does not prove completeness. Cyphrex chooses the leaf set. It does not cover event fields outside the closed leaf.

Daily anchoring is included. Hourly is $150 a month. Every 5 minutes is $750 a month. Real-time is $750 a month plus $25 per 1,000 on-chain authorizations.