Skip to content

Access control you can prove.

Who gets into the networks that run government, defense, and critical services is decided by software that is tested, not proven, and attackers now use AI to find the case nobody tested. IronVelo proves its policy compiler and core libraries correct before deployment: a proof has no untested case.

What we prevent
The type lattice as a Hasse diagram Eight nodes in four levels joined by hairlines, the subset lattice of three elements, lighter at the top and darker as each level refines the one above. One refinement path from the top down to a single node is drawn in orange with a soft halo and that node is filled: the admitted type. The small red ring at the bottom is the empty set: the compile error. The type lattice as a Hasse diagram Eight nodes in four levels joined by hairlines, the subset lattice of three elements, lighter at the top and darker as each level refines the one above. One refinement path from the top down to a single node is drawn in orange with a soft halo and that node is filled: the admitted type. The small red ring at the bottom is the empty set: the compile error.

Why now.

  1. 001AI finds the case nobody tested, at machine speed. In 2026 Google's threat analysts reported the first zero-day exploit they believe was developed with AI: a two-factor authentication bypass caused by a hardcoded trust assumption. Scope-Forge makes access logic policy a proven compiler checks against every possible record.Google Threat Intelligence Group, 2026
  2. 002In 2023 one stolen signing key let an attacker forge tokens and read State and Commerce Department email. Every IronIdP token is backed by a live one-time key on the server: a token matching no live key fails, and a stolen token is useless after its owner's next request.DHS Cyber Safety Review Board report, 2024

Forged for our own identity provider. Available for yours.

Scope-Forge. A formally verified policy compiler. Write 'contractors can never hold a clearance that permits restricted reads' into the policy once. No later change can break it without the build failing and showing the record that would have slipped through.

See Scope-Forge

IronIdP. IronVelo's identity provider. Every login token is backed by a one-time key: a stolen token is useless after its owner's next request, and revocation is instant. Phishing-resistant sign-in with PIV/CAC and FIDO2; FIPS 140-3 validated wolfCrypt cryptography.

See IronIdP

The verified core libraries. Under every IronVelo product, about 54,000 lines of running code carry about 100,000 lines of machine-checked specification and proof, measured in one Verus run.

See the proof

Prove it instead.