Bigwave

Appearance

Agent compliance for regulated industries ​

Design-partner pitch + intake. This page is the public-facing brief for one of Bigwave's two discovery-track wedges — adjacent to the lead agent-harness thesis, validated against buyer pull rather than declared as product direction. If your compliance team is in the room when "can we ship this AI agent" gets discussed, read this end-to-end before opening a Discussion.

The pitch ​

You're running — or want to run — autonomous AI agents inside a regulated environment: a law firm where every agent action that touched a privileged document needs to be reproducible at discovery; a hospital where an LLM that drafts after-visit summaries is in HIPAA scope; a bank whose customer-support agent is FFIEC-relevant the moment it talks to a depositor; a defense contractor whose harness has to hold up under FedRAMP scrutiny. The base model is fine. Your application code is fine. The accountability rail between them — who did what, on whose data, under which policy, when — is the gap.

Bigwave's harness ships that rail. An append-only audit log records every mutating call. A workspace fence makes cross-tenant reads return 404 (not 403, so the existence of the other tenant's data is itself not leaked). The promotion gate is binding — a regressed agent literally cannot reach production. Per-workspace sandbox + guardrail policies are persisted and hot-reloadable, so an auditor can pin "what policy was active on date X" to a row in the database, not a Slack message. This wedge is what those properties look like when the buyer is a compliance officer, not an engineering lead.

We are explicit that this is a discovery-track wedge. The harness substrate (audit + fence + gate + sandbox-policy) is what makes it possible; whether the wedge is commercial is what the design-partner phase is meant to answer. If buyer pull is insufficient by Day 30 we retire the wedge and the substrate work keeps shipping anyway, because the lead wedges depend on the same rails.

Ideal customer profile ​

Concrete buyer signals that say "this wedge is for you":

  • Compliance officer in the room. An InfoSec / GRC / Legal lead has written-mandated audit trails for AI decisions that touch regulated data, and engineering needs an answer that isn't "we'll build it."
  • In-scope for one or more of: SOC 2, HIPAA, GDPR/UK-GDPR, PCI-DSS, FFIEC, FedRAMP, ITAR, CJIS. You don't need every certification today — you need a substrate that doesn't prevent them tomorrow.
  • Regulator-reportable AI failures are non-theoretical. A customer-facing AI mistake in your industry triggers a written report (state attorney general, OCR, FCA, OCC, DoD CIO), not a Slack apology.
  • You can articulate the data classification. "PHI", "PII + payment data", "CUI", "trade secrets", "privileged attorney-client material" — you know what's in scope and what isn't, and you need the harness to enforce that boundary at the storage layer, not in application code.
  • Your AppSec / vendor-review team has already rejected the hosted SaaS option. Data-residency, sovereignty, or contractual constraints mean the harness has to ride inside your VPC or on-prem rack, MIT-or-Apache-2.0 licensed, with no telephone-home.
  • You already have AI agents in production (or staging) but the compliance review is gating the next phase. This wedge is for buyers who are blocked, not buyers who are exploring.

If two or more of those describe you, you're in scope. If your agents only read public data and a wrong answer never leaves an internal demo, this probably isn't the right wedge.

What ships today vs roadmap ​

We are honest about this. Every "today" claim below is verifiable in the repo on main.

TodayRoadmap
Append-only AuditLogRepository (packages/shared/audit.py) — record / list only, no update / delete; every read filters on workspace_idSOC 2 evidence-collector that generates the auditor's binder direct from the audit log
Workspace fence on every repository — cross-tenant reads return 404, not 403 (existence of the other tenant is itself not leaked)HIPAA-specific PHI redaction guardrail (named-entity recognition + redaction rules in the DSL)
EvalGate (packages/eval/gate.py) wired into ReplicaManager.activate — a GateBlock decision returns 422 with the gate's reason and the old adapter handle is preserved (rollback semantics)FedRAMP Moderate readiness package — control-mapping doc + parametrised baseline configs
Per-workspace SandboxPolicy at /admin/sandbox/policy (memory / cpu / pids / wall-clock + fs allowlist + network allowlist) — persisted and hot-reloadable on next session startAudit log signing / notarisation (HMAC chain or Sigstore-style transparency log so tampering is detectable, not just discouraged)
Per-workspace GuardrailPolicy at /admin/guardrails/policy — DSL provider with regex / deny / allow / rewrite / warn, hot-reloads on session startPer-workspace data-classification labels (phi / pii / cui / public) propagated from upload through training through inference
Cross-layer trace_id correlation (migration 0016) — /admin/audit rows link to /admin/inference/{id}, so an auditor can pivot from "this agent action" to "the model call that drove it" in one clickFormal-verification claims for the workspace-fence invariants (the property-based conformance suite is a step toward this)
Persisted token + tool-call budgets on the agent_sessions row (migration 0017) — runtime restart preserves the running tally so a budget-cap is enforced across process boundaries"Right-to-be-forgotten" tooling — surgically null user-identifiable fields in inference / audit / feedback rows while preserving the chain
inference_log rows record cost_usd at write time (frozen Pydantic v2 wire type InferenceLogEntry); the row is the immutable source of truth for billing — no "we recomputed the cost retroactively" class of disputeAuditor-facing "playback" UI: enter a trace_id, get the full chain of audit + inference + gate-decision rows in one timeline
Audit row recorded for every dataset upload, training submit, adapter activation, gate decision, channel mutation, sandbox-policy change, guardrail-policy changeLong-term-retention scheduler (delete-after-N-years) with cryptographic proof-of-deletion for jurisdictions that mandate it
Workspace-conformance test suite (packages/agent_memory/conformance.py and equivalents) asserts the fence is enforced on every repository surfaceAir-gapped install profile (no outbound DNS, no model downloads at runtime, fully offline operator workflow)

Two-line summary: the rails ship, the certifications don't. The audit + fence + binding-gate + per-workspace-policy + frozen billing-ledger substrate is production-ready today; the compliance-package work that turns the substrate into a "check-the-box" deliverable for SOC 2 / HIPAA / FedRAMP auditors is the work we want a design partner to shape.

What "validation working" looks like ​

The metric the design partner and Bigwave watch together, weekly:

  • Audit completeness. Every agent action that touched user-identifiable data has a corresponding AuditLogEntry. Sampling 100 random inference rows from the past week, 100/100 have a matching audit chain that reaches back to the triggering admin action (or the chat call that drove it).
  • Auditor reproduction time. An external auditor (or the partner's GRC lead playing one) can pull the full chain for a given trace_id — every audit row, every inference, every gate decision, every policy version that was active — in under five minutes, using only /admin/audit + /admin/inference + the documented pivot.
  • Cross-tenant fence integrity. Property-based tests that attempt cross-workspace reads on every admin endpoint return 404 (not 403, not 200) for 100 % of attempts. This number does not move; if it ever does, that's a P0 for bigwave.
  • Policy-change traceability. For every change to a SandboxPolicy or GuardrailPolicy, the audit row records the before / after JSON and the actor principal. The partner can answer "what policy was in force when this agent did X" in under 60 seconds.
  • Zero post-write mutations of billing or audit rows. Sampled monthly from the database, no cost_usd value has changed after the row was written, and no audit_logs row has been deleted. (If either invariant breaks, that's a P0 for bigwave.)

If those numbers don't move in the right direction in the first 30 days, something is wrong with the wedge fit and we want to hear about it.

How to engage ​

Demo / quickstart ​

A laptop is enough to exercise the audit + policy substrate end-to-end. The audit + eval-gate sections of apps/docs/guide/architecture.md walk the property-by-property design. The operator runbook for the agent-side path lives in docs/runbooks/agent-harness.md.

bash
# 1. Install bigwave with the default stack.
git clone https://github.com/bigwaveml/bigwave.git
cd bigwave
./install.sh --non-interactive

# 2. Confirm the runtime is up.
bw status
curl -s http://localhost:8080/healthz

# 3. Lock down the workspace's sandbox policy.  The audit log
#    records the before / after JSON and the actor principal.
curl -s -X PUT http://localhost:8080/admin/sandbox/policy \
  -H "Authorization: Bearer $BIGWAVE_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"memory_mb":512,"cpu_quota":0.5,"pids_max":64,
       "wall_clock_s":30,
       "fs_allowlist":["/workspace"],
       "network_allowlist":[]}'

# 4. Pull the audit row that the policy change just produced.
curl -s "http://localhost:8080/admin/audit?action=sandbox_policy_put&limit=1" \
  -H "Authorization: Bearer $BIGWAVE_ADMIN_TOKEN"

# 5. Pivot from an audit row to the inference that drove it.
#    Every audit row carries an `inference_log_id` when the
#    audited action followed a logged inference; that's your
#    one-click chain from "agent did X" to "model call Y".
curl -s "http://localhost:8080/admin/audit?limit=10" \
  -H "Authorization: Bearer $BIGWAVE_ADMIN_TOKEN" \
  | jq '.[0] | {id, action, entity, ts, inference_log_id}'

# 6. Try a cross-tenant read.  The fence returns 404 (not 403).
curl -s -o /dev/null -w "%{http_code}\n" \
  "http://localhost:8080/admin/audit?workspace_id=other-tenant" \
  -H "Authorization: Bearer $BIGWAVE_ADMIN_TOKEN"
# → 404

The end-to-end auditor walkthrough — every dataset upload, every training submit, every gate decision, end-to-end on one trace_id — lives in docs/runbooks/agent-harness.md.

Dual-licensed: MIT OR Apache-2.0

© 2026 bigwave contributors