Monday morning, access still looks like last quarter's org chart: standing admin, unused keys, a contractor grant that should have died. PRAUS is the operator that holds that setpoint on one named plant — a cloud account, a cluster, an IdP — inside a written bridle it cannot be talked out of. Capacity is the dollar on the same glass. The 2am key is the same disable. Land in Observe.
continuous
continuous
grant or kill
reversible only
what you buy
One unit, Identity in Observe, is already PRAUS. Capacity rides on the same glass. The other theaters are expansion, not a different product.
Unit
The horse. An appliance beside one plant, with its own identity, envelope, tape, and modes. This is the SKU.
Theaters
Capability packs you arm on a unit. Not a toolbox to invent agents — certified jobs with closed, reversible maneuvers.
Command
The console: plant map, bridle, tape, take-the-wheel, and the cavalry view across units.
Contract
Optional. PRAUS holds a number — an SLO, a spend cap, an identity bar — and is scored on it.
theaters · the jobs you arm
v1 arms Identity on one cloud account, one cluster, and one IdP. Capacity is the spend line on that holding. Each other theater keeps its own catalog and promotion path. All five is cavalry — still one plant, still not a harness.
Identity
The org chart as a setpoint.
Joiner, mover, leaver as a loop. Unused keys, standing admin, contractor leftovers, privilege that grew and never shrank. This is the first theater we arm.
quiet dayAccess looks like the org chart you meant, every Monday.
Capacity
The dollar on the same glass.
Replica counts, node pools, staging that impersonates prod, idle environments, spend as a setpoint. Never below min-available, never delete data. Companion to Identity on Shape D — not a separate SKU.
quiet dayTuesday does not still look like Friday’s incident.
Release
Fly-by-wire for what is actually running.
Holds “this SHA is the plant.” Canary, pause, abort, rollback, pin. A human still owns merge; PRAUS owns whether that merge stays live.
quiet dayA deploy that is green but worse than last week gets a stamped undo — not a Slack essay.
Continuity
Keep the mission on the line.
Drain, cordon, fail over, rebalance, shift traffic, restart the stuck job — the moves a calm SRE would run before it is an incident.
quiet dayOne sick node is not a hero story.
Exposure
The attack surface as a setpoint.
Public buckets, 0.0.0.0/0 rules, leftover listeners, secrets in the wrong place. Close, isolate, rotate, unpublish.
quiet dayThe plant is as closed as the bridle says it is.
Sentry watches the program. GitOps reconciles one YAML plane.
PRAUS is the operator of the running estate — across the planes you commission.
the night we build
Quiet-day Identity is the product. Incident containment is that catalog under stress. Every card still has an unwind, or the envelope kills it. Sample plant — no live system is connected.
Contractor.jane still has an Okta grant. The contract ended fourteen days ago. Nothing broke.
AKIA…8F2 has not been used in 211 days. Standing admin is still 4. The lock is 0.
That same key answers from an ASN it has never seen. The Monday actuator is the containment.
the hard envelope
Every maneuver the model proposes passes through a gate outside the model. The gate checks four questions and it cannot be talked out of any of them: is the resource named in this unit's plant, does a working unwind exist, are we under the rate cap, and is the verification path live.
Named plant only
One account, one cluster, one identity provider. Nothing else is addressable.
Reversible or refused
No actuator ships without an unwind. Destructive verbs do not exist in the library.
Rate and blast caps
A bounded number of moves per hour, per surface, per unit.
Verify or freeze
If the world did not move exactly that far, it stops at last known good.
a killed proposal is not an error. it is the product working.
the loop · Monday and 2am
Incident response is the Identity catalog under stress. Most of the shift is quieter: standing admin, unused keys, grants that should have died.
01
Sense
Read only the plant it was commissioned to see.
02
Decide
Reason about the deviation. Propose one maneuver and its unwind.
03
Envelope
Grant it, or kill it. Outside code the model cannot reach.
04
Actuate
One closed, reversible move against the real world.
05
Verify
Prove the world moved exactly that far, and no further.
06
Unwind
If not, undo and freeze at last known good. Wake the wheel.
closed actuator library
PRAUS does not have a shell. It has verbs. There is no arbitrary command execution to audit, no free-form script to review — only this closed set, each paired with the action that returns the estate to where it was.
expire grant
unwind
restore named grant
disable key
unwind
set named key Active
revoke session
unwind
re-enable named sign-in
scale down
unwind
restore previous desired
rollback
unwind
re-deploy prior release
isolate
unwind
restore network position
drain
unwind
uncordon the node
unpublish
unwind
restore named DNS / listener
four reins · promotion is the motion
Sees, scores, writes the tape. Touches nothing.
Proposes the maneuver and the unwind. Waits.
Acts inside the envelope with a human on the dead-man switch.
Acts and verifies unattended. The whisper still stops it.
riding the unit · not settings, the product
The ladder runs per theater, per actuator class — never as a global switch. Each rung has a sign-off, a shadow score, and a certificate on the tape. These are the instruments on the console, not features in a menu.
Plant map
The estate as a field the horse is standing on, not a chart wall. Click a region — see the bridle, the last maneuvers, the tape.
Setpoint lock
“This week was good. Hold it.” Capture the live plant as the setpoint instead of writing YAML from memory.
Blast-radius preview
Before a theater is armed, see what a full-autonomous week would be allowed to touch. If that picture is wrong, do not arm it.
Shadow week
Seven days of would-have maneuvers written to the tape against live state. Promotion is a review of the shadow tape, not a leap.
Maneuver cards
Every proposed act is a card: actuator, target, expect, unwind, verdict. If it cannot become a card, it does not exist.
Whisper
Natural language that compiles to a maneuver or refuses. Never to a shell. A rider’s cue, not a jailbreak.
Twin
Dry-run against a live-shaped copy — same envelope, same actuators, no side effects. If it cannot run on the twin, it does not run on the plant.
Take the wheel
A human rides without raw admin: pick a maneuver, and the horse still runs envelope → act → verify → unwind.
Dead-man
Supervised acts unless aborted in N seconds. Silence is consent inside the bridle only — never past it.
Change calendar
Deploy windows, freeze periods, do-not-scale-on-Friday. Maneuvers outside the calendar are refused or held.
Outcome contracts
Hold error budget, hold spend under a number, hold “no standing admin” — scored on the console.
Cavalry view
Two units or twenty: which horse, which plant, which mode, last maneuver. One bridle per unit. No shared brain.
sample commission · Shape D
Commission a second unit for a second account and you do not get a platform. You get cavalry — each horse still answers for one theater.
unit: hz-01 # sample plant: aws:1234 · eks/prod · okta/acme shape: D theaters: [identity] # capacity rides along setpoint: standing_admin: 0 unused_keys: 0 grants: org-chart staging_replicas: 12 mode: observe envelope: - deny: delete_data_store - deny: widen_own_iam - allow_resources: [named only] - require: unwind_for_every_actuation - rate_cap: 6 moves / hour - on_verify_fail: freeze_last_known_good wheel: oncall-primary, ciso (whisper-stop) recorder: sample tape
unlike
The scarce thing was never another model with tools. It is an actor production will accept: identity, envelope, reversibility, evidence.
πραΰς — a warhorse that still has the charge
Full strength, held on a whisper. Land Identity in Observe on one named plant. Earn the disable. Never take a move you cannot take back.
