MagenTrust applies one in-perimeter policy and evidence layer to human-operated UI sessions and trusted machine-to-machine API actions. MagenTrust runs inside the customer's perimeter and supports fully air-gapped deployment, including isolated hospital and defense networks. No data leaves the environment. Inside your authorization boundary: MagenTrust deploys inside your environment, on your infrastructure, with no data leaving your network. It can be assessed as a component of your system's existing ATO instead of requiring a separate cloud authorization. Air-gapped when it matters: Runs fully disconnected on isolated defense and hospital networks. Security controls cover encryption, access, incident response, deterministic enforcement, and signed audit records without PII or data egress. All connections require TLS 1.2 or higher, and TLS 1.3 is preferred. Cipher suites follow NIST SP 800-52 Rev. 2 guidance. Every PASS, CHALLENGE and INTERRUPT decision produces a signed audit record so tampering can be detected. Audit records export via syslog (RFC 5424) and as JSON over HTTPS, compatible with standard SIEM platforms. Retention is set by the customer, from 30 days up to 7 years. Deployment, transport security, API keys, audit records, signed policies, failure behavior, privacy by design and the decision model are published below. We recommend rotating API keys every 90 days. Keys can be rotated with no downtime: create a new key, move traffic to it, then revoke the old one. Human Exclusion Zone policies are written in YAML or JSON, versioned, and signed so any change to a policy is detectable. If MagenTrust is unreachable: Customers choose how each protected action behaves if a decision can't be returned in time. Fail-closed blocks the action until MagenTrust responds, which suits high-consequence actions. Fail-open lets the action proceed and logs it for review, which suits lower-risk workflows. The setting is part of policy, so different actions can use different modes. Privacy by design: Behavioral signals are processed ephemerally into scores. Keystroke and interaction timing are treated as behavioral signals, scored ephemerally and never retained. No raw behavioral data or biometric templates are stored. Decision model: Decisions are deterministic given policy thresholds applied to a probabilistic confidence score: the same score and policy always produce the same PASS, CHALLENGE or INTERRUPT.