Local first
Safety decisions continue when cloud services or network links disappear.
Trust, at the
point of action.
Open physical interlocks. Bounder verifies narrow authority, checks live conditions locally, and permits only device-safe action.
Local by design. Auditable by construction. Safe-state behavior remains device-specific.
The proposition
Digital governance needs a last metre.
Policy platforms can decide. Assurance systems can attest. Devices can act. The dangerous gap is the translation between them.
Bounder is a small, inspectable gate for that boundary. It turns signed policy, optional verified evidence, and local state into an allow or deny decision, while a device-specific adapter owns the safest physical response.
Four layers. One narrow handoff.
Authority gets smaller as it approaches the machine.
-
Govern
Creed Space Fleet distributes one signed protective rule across an enrolled team, with immutable policy provenance.
-
Issue
Fleet creates a short-lived, device-bound projection with a monotonic sequence for every Bounder guardian.
-
Bound
Bounder checks signature, subject, expiry, replay sequence, action scope, and local sensors.
-
Act safely
A reviewed adapter chooses hold, return, land, isolate, escalate, or no state change.
Optional evidence is never a remote-control channel. Configured systems may satisfy an explicit signed precondition. They do not send arbitrary actuator commands.
Authority that expires. Safety that stays local.
Cryptographically narrow
Policies bind issuer, subject, validity, sequence, actions, and constraints.
Deny new authority
Missing, stale, replayed, or ambiguous evidence cannot create permission.
Fail physically safe
Each device defines its safe transition through a documented hazard analysis.
The pattern travels beyond drones.
Guardian is the general pattern.
Bounder is the Guardian for embodied movement and physical-action boundaries.
Creed Space Fleet distributes and governs its policies.
It need not be limited to drones. The same architecture could cover ground robots, autonomous boats, warehouse vehicles, inspection platforms and even fixed machinery with spatial or safety interlocks.
Autonomous vehicles
Gate takeoff or mission changes on identity, location, time, battery, and a current signed policy.
Laboratory systems
Enable hazardous modes only when verified operator, protocol, and physical conditions agree.
Robots in shared space
Require current consent and supervision evidence before entering human environments.
Critical maintenance
Combine a signed maintenance window with a local key, measured state, and an auditable receipt.
Watch the boundary hold.
Explore civilian protection, friendly-force separation, protected people and places, surrender, incapacitation, positive identification, proportionality, human authorization, communications, policy integrity, and one Creed Space policy enforced across an entire simulated fleet.
Safety boundary
Reference software, honestly labelled.
Bounder is not certified flight-control software, a regulatory authorization service, or a replacement for manufacturer failsafes.
- Verified: software-only signature, expiry, replay, assurance, command, and sensor checks.
- Evidenced: sixteen-device Fleet distribution, local guardian decisions, revocation, disconnect, and structured audit receipts.
- Boundary: high-consequence scenarios are evidence-only and can never authorize an actuator. There is no targeting, engagement selection, live actuator transport, or hardware validation.
Help build the missing boundary.
Use the interlock pattern, challenge the threat model, extend the simulator, or connect a governance control plane.