Question 1

What is Daylite?

Accepted Answer

Daylite is the runtime enforcement and verifiable audit layer for AI agents in regulated enterprises. It is a self-hosted Rust binary that sits at the MCP tool-call boundary. It checks each agent action against policy before the action runs and decides whether it executes, then writes a tamper-evident, cryptographically signed record of what was requested, what policy decided, and what actually ran. It deploys in your VPC, on-prem, or in an air-gapped network.

Question 2

How is Daylite different from Vanta, Drata, Credo AI, or OneTrust?

Accepted Answer

Those tools document and score policy. They map it to frameworks and produce reports, and they sit out-of-band from the running agent, so they cannot block a non-compliant tool-call. Daylite enforces policy at the tool-call boundary at runtime and produces cryptographic proof of what the agent actually did. Keep your governance tool for documentation. Daylite sits beneath it.

Question 3

What does 'built on FIPS-validated cryptography' mean?

Accepted Answer

Daylite runs its cryptography through AWS-LC, a FIPS 140-3 validated cryptographic library. Daylite itself is not product-certified under CMVP, and we do not claim a CMVP certificate. Commercial enterprise procurement under SOC 2, HIPAA, and DORA accepts library-level validation. FedRAMP High and certain DoD contracts require product-level CMVP, which is on the roadmap.

Question 4

How does an auditor use the evidence?

Accepted Answer

Your team runs one command to export the record. The auditor verifies the hash-chain offline with the verify tool, confirms no entry was changed after it was written, and reviews the decisions. The format is open, so there is no lock-in on the evidence itself, and no trust in Daylite is required to check it.

Question 5

Where does Daylite run, and where does the data go?

Accepted Answer

Daylite is self-hosted and air-gap capable. It runs in your VPC, on-prem, or in a disconnected network. Data never leaves your environment. That disqualifies cloud-only governance tools in banking and defense, and it is why Daylite fits where they cannot.

Question 6

How long does Daylite take to deploy?

Accepted Answer

Minutes. Docker ships today. Run the container, point your agents at the MCP proxy, and the policy gate and the hash-chain audit are live. A Helm chart for Kubernetes is on the roadmap.

Blog