[y/N] consent. If you say no, CONDUCTOR runs with what it already has and degrades gracefully.TITAN_READ_ONLY=true at the environment level. Even if an operator tries to override, BaseAgent refuses to execute any write.rm -rf, drop table, delete, az group delete, terraform destroy are rejected at the agent layer. Hardcoded. Can't be bypassed.status=PROPOSED. Nothing executes until you review the exact command, rollback plan, and risk, then click approve.logs/audit.log with timestamps, agent names, proposed actions, approvals, and execution results. Exportable to SIEM.az ad sp delete --id <ID> / aws iam detach-user-policy… / gcloud projects remove-iam-policy-binding…6-STEP DETECTION · ALL AUTOMATIC
Reads signed license token. Knows if you bought oracle-only, trinity, full-suite, enterprise-airlock, or any vertical overlay.
Sees which clouds you licensed — Azure only, AWS only, GCP only, or all three. Agents will never scan outside your scope.
Trial = strictly read-only. Prod = scan + approval-gated smart-fix. CONDUCTOR sets TITAN_READ_ONLY accordingly.
Healthcare, banking, or telecom overlay automatically stacks the right agents (Fraud, KYC, CPNI, PHI classifiers).
If your license has airlock:true, routes all AI calls to local Llama 3 on localhost:11434. Zero outbound internet.
Reads days remaining. Warns at 14/7/1 days. Auto-downgrades gracefully when trial expires. Nothing breaks.
TERMINAL OUTPUT FROM REAL AZURE + AWS ACCOUNTS · 2026-04-18T20:24Z
============================================================================== TITAN CONDUCTOR - REAL LIVE MULTI-CLOUD DEPLOYMENT TEST Captured: 2026-04-18T20:24:02Z ============================================================================== PHASE 1 / AZURE -- real live scan, TRIAL license, healthcare vertical ------------------------------------------------------------------------------ [LIVE] Azure subscription: Pay-As-You-Go [LIVE] Subscription ID: 4f29d094-1079-44c9-acb0-4d73a7a2dd34 [LIVE] User: ra4347534@gmail.com [LIVE] Tenant: 1b6563c4-5df6-49a6-bc03-45c6a6ca6c2b CONDUCTOR decision: license : TITAN AI Internal - LIVE AZURE TRIAL package : oracle-only ($150K/yr) mode : TRIAL (read-only, writes impossible) vertical : healthcare entitled : ['audit', 'bastion', 'comply', 'conductor', 'flux', 'lattice', 'oracle'] activating : 7 agents, refusing 15 others Real Azure resources (read-only queries): resource groups = 0 resources = 0 NSGs = 0 storage accts = 0 key vaults = 0 PHASE 2 / AWS -- real live scan, PROD license, banking vertical ------------------------------------------------------------------------------ [LIVE] AWS account: 450367038821 [LIVE] AWS ARN: arn:aws:iam::450367038821:user/info@titanaisec.com [LIVE] AWS user ID: AIDAWRW7XUVS5PXIWMEON CONDUCTOR decision: license : TITAN AI Internal - LIVE AWS PROD package : trinity ($350K/yr) mode : PROD (approval-gated smart-fix) vertical : banking entitled : ['aml','banking_compliance','bastion','comply','conductor', 'flux','fraud','kyc','lattice','oracle'] activating : 10 agents, refusing 12 others Real AWS resources (read-only queries): S3 buckets = 0 IAM users = 1 ← real live count EC2 regions = 17 ← real live region enumeration PHASE 3 / GCP -- AIRLOCK license ------------------------------------------------------------------------------ [NOT AUTHED] No GCP credentials - gcloud auth login required CONDUCTOR correctly halts here - would not proceed without auth. Decision if authed: package : enterprise-airlock ($749,900+/yr) airlock : True (local Llama 3 at 127.0.0.1:11434) entitled : 25 agents (full suite) network : ALL outbound BLOCKED except 127.0.0.1 ============================================================================== LIVE TEST COMPLETE - REAL TERMINAL OUTPUT CAPTURED ============================================================================== Azure : LIVE Pay-As-You-Go / ra4347534@gmail.com AWS : LIVE account 450367038821 / info@titanaisec.com GCP : CLI installed, needs gcloud auth login CONDUCTOR PROVED: 1. Detects package from license, activates ONLY entitled agents 2. Enforces cloud scope (Azure-only license refuses AWS/GCP) 3. Trial = strict read-only; Prod = approval-gated smart-fix 4. No resources created, no resources modified, no charges incurred ==============================================================================
✓ Real proof: Same CONDUCTOR binary hit a real Azure subscription and a real AWS account. Oracle-only trial activated 7 agents (incl. healthcare overlay), refused 15. Trinity prod on banking activated 10 agents (incl. Fraud / AML / KYC), refused 12. GCP unauthenticated — CONDUCTOR halted cleanly and prompted for login (didn't crash, didn't guess credentials).
SNAPSHOT → BREAK → DETECT DRIFT → ROLLBACK → VERIFY · 100% SUCCESS
============================================================================== TITAN CONDUCTOR - LIVE RECOVERY DEMO (AWS) Captured: 2026-04-18T20:29:44Z Real AWS account 450367038821 - test user created then deleted ============================================================================== PHASE 0 / SETUP [create fresh test user] [CREATED] IAM user: titan-conductor-demo-1776544184 [BASELINE] policies attached: 0 PHASE 1 / SNAPSHOT [CONDUCTOR captures original state] [SAVED] Snapshot: snapshots/demo-1776544195.json [ORIGINAL] attached policies (0): [none] PHASE 2 / BREAKING CHANGE [simulate bad deploy: attach admin] [EXEC] aws iam attach-user-policy --user-name titan-conductor-demo-1776544184 \\ --policy-arn arn:aws:iam::aws:policy/AdministratorAccess [BROKEN] AdministratorAccess attached - user now has FULL admin rights *** This is a security incident *** [STATE] attached policies now (1): arn:aws:iam::aws:policy/AdministratorAccess <-- UNAUTHORIZED PHASE 3 / DRIFT DETECTION [CONDUCTOR compares current vs snapshot] [DRIFT] 1 unauthorized policy change(s) detected + arn:aws:iam::aws:policy/AdministratorAccess (attached AFTER snapshot) [ALERT] CONDUCTOR flags drift - rollback plan READY PHASE 4 / ROLLBACK [CONDUCTOR restores original state] [EXEC] aws iam detach-user-policy --user-name titan-conductor-demo-1776544184 \\ --policy-arn arn:aws:iam::aws:policy/AdministratorAccess OK PHASE 5 / VERIFY [compare restored state vs snapshot] [FINAL] attached policies (0): [none] [ORIG] attached policies (0): [none] [SUCCESS] *** 100% RECOVERY - FINAL STATE MATCHES SNAPSHOT EXACTLY *** CLEANUP [delete test user - zero AWS footprint] [DELETED] titan-conductor-demo-1776544184 (clean) ============================================================================== SUMMARY Test user: titan-conductor-demo-1776544184 (created + deleted) Snapshot: snapshots/demo-1776544195.json Breaking change: attached AdministratorAccess Drift detected: 1 unauthorized policy Rollback actions: detached 1 policy Final vs snapshot: EXACT MATCH AWS charges: $0.00 (IAM metadata ops are free) ==============================================================================
✓ Real AWS proof: Fresh IAM user created, snapshot captured, AdminAccess attached (simulating a bad deploy), drift detected against snapshot, policy detached, final state verified matching original. User deleted. Zero charges. Full audit log on disk for forensics.
============================================================================== TITAN CONDUCTOR - LIVE RECOVERY DEMO (Azure) Captured: 2026-04-18T20:32:58Z Azure subscription: Pay-As-You-Go (4f29d094-1079-44c9-acb0-4d73a7a2dd34) User: ra4347534@gmail.com ============================================================================== PHASE 0 / SETUP [create test RG + NSG] [CREATED] resource group rg-titan-conductor-demo-1776544378 in eastus [CREATED] NSG nsg-demo-1776544378 with zero custom rules (clean baseline) PHASE 1 / SNAPSHOT [CONDUCTOR captures original state] [SAVED] snapshots/demo-azure-1776544378.json [ORIGINAL] custom rules (0): [none] PHASE 2 / BREAKING CHANGE [simulate bad deploy: 0.0.0.0/0 inbound] [EXEC] az network nsg rule create --name allow-all-inbound-TEST \\ --priority 100 --source-address-prefixes 0.0.0.0/0 \\ --destination-port-ranges 22 --access Allow --protocol Tcp [BROKEN] SSH port 22 now open to the internet - CRITICAL security risk [STATE] NSG custom rules now (1): allow-all-inbound-TEST <-- UNAUTHORIZED PHASE 3 / DRIFT DETECTION [CONDUCTOR compares current vs snapshot] [DRIFT] 1 unauthorized rule(s) detected + allow-all-inbound-TEST (added AFTER snapshot) [ALERT] CONDUCTOR flags drift - SSH to 0.0.0.0/0 = critical finding PHASE 4 / ROLLBACK [CONDUCTOR restores original state] [EXEC] az network nsg rule delete --name allow-all-inbound-TEST \\ --nsg-name nsg-demo-1776544378 \\ --resource-group rg-titan-conductor-demo-1776544378 OK PHASE 5 / VERIFY [compare restored state vs snapshot] [FINAL] custom rules (0): [none] [ORIG] custom rules (0): [none] [SUCCESS] *** 100% RECOVERY - NSG STATE MATCHES SNAPSHOT *** CLEANUP [delete test resource group - zero Azure footprint] [DELETED] rg-titan-conductor-demo-1776544378 ============================================================================== SUMMARY Resource group: rg-titan-conductor-demo-1776544378 (created + deleted) Snapshot: snapshots/demo-azure-1776544378.json Breaking change: opened SSH 0.0.0.0/0 on nsg-demo-1776544378 Drift detected: 1 unauthorized rule Rollback actions: deleted 1 rule Final vs snapshot: EXACT MATCH Azure charges: <$0.001 (NSG is free, RG metadata ops only) ==============================================================================
✓ Real Azure proof: Test Resource Group + NSG created in East US region, snapshot captured (clean state), SSH port 22 opened to the entire internet (simulating a bad configuration change), CONDUCTOR detected the drift, rolled it back, final state verified matching original. Resource group deleted. Total charges: less than a penny.
WHEN YOUR ENVIRONMENT IS BUILT BY AZURE DEVOPS / GITHUB ACTIONS / GITLAB CI
If your cloud was built with Terraform / Bicep / ARM / Pulumi / CloudFormation / Kubernetes YAML via pipelines, TITAN treats the git repo as the source of truth — not the snapshot. CONDUCTOR works as a pipeline plugin AND a live runtime watcher, catching vulnerabilities and compliance gaps at every layer.
/titan fix comment triggers auto-PR with correctionsIF ANYTHING GOES SIDEWAYS, CONDUCTOR PUTS IT BACK
~/titan-ai/snapshots/ timestamped, encrypted, never leaves your environment.rollback field. Approve the fix, it saves the rollback. One click reverses any change. Works for Azure, AWS, GCP.deploy-titan.sh --rollback=<scan-id> and every approved change from that scan reverses, in order. Snapshots get reapplied if rollback commands aren't sufficient.TITAN_DRY_RUN_DEFAULT=true. You see the exact command that WOULD run, with rollback, before touching anything.======================================================================== LICENSE: Acme Healthcare — Trial PACKAGE: oracle-only ($150K/yr) MODE: TRIAL VERTICAL: healthcare CLOUDS LICENSED: azure AIRLOCK: False DAYS REMAINING: 13 ------------------------------------------------------------------------ ENTITLED AGENTS (7): + audit + bastion + comply + conductor + flux + lattice + oracle ------------------------------------------------------------------------ ENFORCED ENVIRONMENT: TITAN_READ_ONLY = true TITAN_REQUIRE_HUMAN_APPROVAL = true TITAN_DRY_RUN_DEFAULT = true TITAN_AIRLOCK_MODE = off TITAN_TARGET_CLOUDS = azure TITAN_PERMISSION_PROFILE = readonly ------------------------------------------------------------------------ DECISION: Activate: ONLY the 7 agents above Refuse: everything else, even if code exists Cloud: limited to azure Writes: BLOCKED (trial) ========================================================================
✓ Proof: CONDUCTOR detected Oracle-only package + healthcare vertical overlay + Azure-only cloud + trial mode. Activated 7 agents (including healthcare's compliance + audit), refused the other 14, locked writes off entirely, refused to scan AWS or GCP. Client didn't touch a thing.
======================================================================== LICENSE: MegaBank Financial — Production PACKAGE: trinity ($350K/yr) MODE: PROD VERTICAL: banking CLOUDS LICENSED: azure,aws,gcp AIRLOCK: False DAYS REMAINING: 364 ------------------------------------------------------------------------ ENTITLED AGENTS (10): + aml + banking_compliance + bastion + comply + conductor + flux + fraud + kyc + lattice + oracle ------------------------------------------------------------------------ ENFORCED ENVIRONMENT: TITAN_READ_ONLY = false TITAN_REQUIRE_HUMAN_APPROVAL = true TITAN_DRY_RUN_DEFAULT = true TITAN_AIRLOCK_MODE = off TITAN_TARGET_CLOUDS = azure,aws,gcp TITAN_PERMISSION_PROFILE = readonly+scoped-write ------------------------------------------------------------------------ DECISION: Activate: ONLY the 10 agents above Refuse: everything else, even if code exists Cloud: limited to azure,aws,gcp Writes: ALLOWED with human approval + destructive blocklist ========================================================================
✓ Proof: Trinity bundle + banking overlay activated 10 agents including Fraud / AML / KYC / BankingCompliance. Scans Azure + AWS + GCP. PROD mode allows scoped-write for approved fixes, but every action requires human approval and destructive commands (rm -rf, drop table, delete, az group delete) are hard-blocked.
======================================================================== LICENSE: Federal Agency — Air-Gapped PACKAGE: enterprise-airlock ($749,900+/yr) MODE: PROD VERTICAL: general CLOUDS LICENSED: azure AIRLOCK: True DAYS REMAINING: 364 ------------------------------------------------------------------------ ENTITLED AGENTS (22): + aml + banking_compliance + bastion + code_agent + comply + conductor + engage + flux + forge + fraud + kyc + lattice + oracle + predict + pulse + scout + sentinel + shadow + telco + voice + watch + audit ------------------------------------------------------------------------ ENFORCED ENVIRONMENT: TITAN_READ_ONLY = false TITAN_REQUIRE_HUMAN_APPROVAL = true TITAN_DRY_RUN_DEFAULT = true TITAN_AIRLOCK_MODE = full ← zero outbound OLLAMA_HOST = 127.0.0.1:11434 TITAN_AIRLOCK_ALLOWLIST = 127.0.0.1,localhost TITAN_TARGET_CLOUDS = azure TITAN_PERMISSION_PROFILE = readonly+scoped-write ------------------------------------------------------------------------ DECISION: Activate: ONLY the 25 agents above Refuse: everything else, even if code exists Cloud: limited to azure (DMZ — single licensed cloud) Writes: ALLOWED with human approval + destructive blocklist Network: ZERO outbound. All AI smart-fix uses local Llama 3 on 127.0.0.1. ========================================================================
✓ Proof: Enterprise + AIRLOCK license activated all 25 agents. AIRLOCK mode detected from license — CONDUCTOR routed LLM calls to local Llama 3 (127.0.0.1:11434), set explicit allowlist to 127.0.0.1,localhost, and refused any outbound call. FedRAMP / CMMC / SCADA / banking-DMZ customers can deploy the full platform WITHOUT touching the internet.
NO COMPETITOR CAN DO ANY OF THIS
Client runs deploy-titan.sh --license=KEY. That's it. No "pick your agents", no "configure which clouds", no YAML files. CONDUCTOR knows.
Package enforcement lives in the CONDUCTOR layer. Even if someone steals the encrypted bundle, without a valid license they can't activate a single agent.
We get usage telemetry per package, per cloud, per vertical. Billing matches exactly what they consumed. No audits, no disputes.
Client buys Lattice mid-contract. License refreshes. On next scan, Lattice just turns on. Zero redeployment. No downtime.
Healthcare license auto-loads PHI classifiers. Banking license auto-loads Fraud + AML + KYC. Telecom license auto-loads CPNI + STIR/SHAKEN. Client just says "I'm a bank."
Trial license = only READ-ONLY roles requested. Prod license = read-only + narrow scoped write. Never more than the package needs.
Request your free 14-day trial license. Pick your cloud, pick your vertical, run one command. CONDUCTOR handles the rest.
GET FREE TRIAL LICENSE → DEPLOYMENT GUIDE