# IntentGuard

> Autonomous protection for every device.

IntentGuard is an IntentForce product concept for an AI-assisted security gateway, endpoint protection, anti-spyware, anti-spam and controlled agent operations.

## Public proof

- Product: IntentGuard
- Publisher: IntentForce
- Status: isolated interactive proof-of-concept with a signed, repeatable multi-node lab
- Public demo: https://intentguard-demo.rust.finnandre.no/
- Machine-readable evidence: https://intentguard-demo.rust.finnandre.no/evidence.json
- Signed lab evidence: https://intentguard-demo.rust.finnandre.no/lab/public-evidence.json
- Product site: https://www.intentforce.no/intentguard/
- Published: 2026-09-25

## Demonstrated

- Interactive security event simulation in the browser.
- Policy-bounded response sequence with temporary device isolation.
- Visible verification and rollback flow.
- Separate static container with no customer data, secrets or operational access.
- Semantic HTML, JSON-LD, robots policy, sitemap and this LLM-readable summary.
- A run-on-demand three-node lab with mutual TLS identities and Ed25519-signed events and acknowledgements.
- Alert propagation to a linked responder, identity and role enforcement, unsigned-message and replay rejection.
- A hash-chained event log and a deception enclave with synthetic-only decoys, no public ports, no external interface and denied egress.

## Available on request

- An isolated IntentGuard Deception Mode pilot using honeypots, honeytokens and sinkholes.
- Suspicious activity can be diverted into believable but non-sensitive decoys with outbound and lateral movement denied.
- The pilot must be separately scoped, isolated and tested; it is not active in this public proof.
- Customer-specific security systems that detect, coordinate and self-update within signed policies, staged rollout, health gates and automatic rollback.
- A high-assurance program covering secure boot, signed updates, protected key storage, zero-trust segmentation, tamper-resistant logs, secure recovery, threat modeling, fuzzing, penetration testing, independent review, compromised-node response and supply-chain scenarios.
- Production gateway, endpoint, antivirus, anti-spyware and email security engines developed and validated in customer-specific stages.

## Explicit limitations

The browser proof does not inspect real network traffic, scan real endpoints, send email, operate a router, run a public honeypot or invoke Codex. The separate lab run uses only synthetic data and is not continuously active. It proves selected architecture controls, not production engines, secure boot, autonomous production updates, penetration-test results, independent certification or resistance to every supply-chain attack.