A Visual Tour

One fabric, drawn out. Here is what your organization looks like wearing it.

Four views, from the whole organization down to a single packet's life — every structure inside ApAnA, and where the line of custody is drawn.

I run APIs — join the design cohort
View I — The Organization

Every department keeps its own engine. Only proof rises.

Each team runs an ApAnA engine inside its own boundary. Payloads move laterally through local sieves; the hosted registry above receives nothing but contract versions and receipt hashes.

ApAnA Registry · Hosted Contracts · Drift Alerts · Receipt Anchors holds hashes only — never payloads The line of custody — data below never crosses Your organization · your infrastructure Engineering Engine Node GASKET-PII-v1 · GASKET-SOC2-v1 local WORM ledger append-only · hash-chained Finance Engine Node GASKET-FIN-v2 · GASKET-PII-v1 local WORM ledger append-only · hash-chained People / HR Engine Node GASKET-HR-v1 · retention schedule local WORM ledger append-only · hash-chained payloads payloads sha256 anchors ↑ → partners receive only sanitized flow
Reading the diagram: solid gold streams are payload traffic — they never leave your boundary except through a sieve. The faint dotted streams rising to the registry carry cryptographic hashes only. If ApAnA-the-company disappeared tomorrow, your engines and ledgers keep running; they're yours.
View II — Inside the Engine

Four chambers. One deterministic path.

Every packet walks the same corridor: identity is recognized, policy executes, what shouldn't pass is removed, and the event is committed to the ledger before delivery.

Inbound clean + sensitive mixed 1 · Identity Gateway Recognize SAML / OIDC / OAuth in → normalized session token out bind(session, origin) 2 · Compliance Sieve Evaluate active gaskets execute against every field policy(packet) → verdict 3 · Sanitization Remove unauthorized fields surgically redacted redact(pii) · attach ttl sensitive residue → shredded on TTL 4 · WORM Ledger Attest signed receipt committed before delivery completes append(receipt) → hash Delivered · clean
The two streams: the gold line is data that policy allows; the red line is sensitive material — it travels only as far as the sanitizer, is held under a strict TTL, and is destroyed with a receipt. Nothing exits chamber four unattested. The control is the evidence.
View III — Between Two Companies

Standing agreements, kept standing.

Two organizations pin a contract version in the registry. When either side's policy moves, both engines know before anything breaks.

Registry CONTRACT AB — v3.1 (pinned) schema hash · policy versions · drift watch Company A Engine · policy v3.1 emits sanitized flow under contract terms Company B Engine · policy v3.1 verifies inbound flow against same terms payloads — direct, never through the registry version ping ↑ ↑ version ping B ships policy v3.2 → registry flags drift → A alerted before the integration breaks
Why this matters: today, integrations break silently when a partner changes their API's policy or schema — you find out from angry users. Under a pinned contract, drift becomes a notification, not an outage. Auto-reconciliation between versions is on our roadmap; drift detection ships first, because honesty ships before magic.
View IV — The Life of One Packet

Born, examined, delivered, destroyed — and remembered.

Six moments, deterministic every time. The packet dies on schedule; its receipt lives forever.

01

Ingest

Packet arrives; identity recognized and bound to a cryptographic session.

02

Evaluate

Active gaskets execute against every field. Verdict is deterministic — same packet, same policy, same result.

03

Redact

Fields the policy forbids are surgically removed. A TTL lease is stamped on anything retained.

04

Deliver

The sanitized packet exits to its destination — inside the org or to a contracted partner.

05

Expire

The TTL lapses. The engine destroys the retained material — autonomously, without being asked.

06

Attest

A signed shred receipt is committed to the local ledger; its hash is anchored to the registry. Proof, forever.

See It With Your Own Traffic

The diagrams are the promise. The design-partner beta is the proof.

I'm an auditor — I want to test this