Prove
Know what you have — and prove it was right.
AXON reads what's running, compares it with what you declared, and keeps a record of every difference.
NeedsRead-only on the cloud
● Shipped · 53 of 78 resource types
How it worksThe long read
An AI that plans. An engine that proves every step.
You talk to the AI. It plans. A rules engine does the work, checks it against AWS and writes it down.
- You ask
- The AI plans
- You approve
- The engine acts, checked against AWS
- Recorded, so edits show
Getting started · three steps
Connect, declare, and see what changed.
- 01
Connect AWS
Create a read-only role in your account and give AXON its name. AXON never holds a key.
- 02
Declare your setup
A short contract in your own git repository, drafted for you from what you already run.
- 03
See what changed
Every difference shows up as a finding, sent where your team works, with evidence ready for your auditor.
How AXON is different
Compared, line by line.
| Question | AXON | Typical tools |
|---|---|---|
| Your intended setup | A contract in your own git repo, drafted from what you run | Checklists or policies inside the vendor's tool |
| “What was running last March?” | Answers for any date since you connected it, with the commit that approved it | Today's state; history rebuilt from logs |
| The record | Each entry chained to the last, so an edit shows | Exports and screenshots |
| Deciding what's wrong | Rules you can read. No AI in the decision | Varies; increasingly AI-assisted |
| Access to your AWS | A read-only role you create. AXON can't store a key | A role or API keys, depending on the tool |
| Fixing drift | Only on a person's click, read back from AWS, undoable. S3, IAM and EC2/VPC so far | Alerts and tickets, or automatic changes |
| Audit time | A dated evidence pack, ready to hand over | Evidence gathered by hand |
The problem, as the founder has lived it
Cloud changes go unnoticed.Until the audit.
Every SOC 2 audit I have seen, someone rebuilds months of change evidence by hand, from CloudTrail exports, git history and screenshots. The change itself happened long before; nobody was watching the space between what was declared and what was running.
TodayFound when somebody asks, usually the auditor.With AXONRead every 15 minutes, compared with what you declared, and sealed in a record you can hand over.
Saad Ansari, founder. Cloud architect since 2015, eleven years inside enterprise clouds. AXON is in early access. We're looking for our first three design partners on AWS.
How AXON checks
AXON compares what's running with what you said should be running.
What's runningYour AWS, read every 15 minutes through a read-only role you create. AXON never holds a key.
What you declaredA short file in your own git repo, drafted for you from what you already run.
The recordEvery difference, timestamped and chained so any edit shows. Your auditor can check it without trusting us.
AdaptersAWSGCPAzureGitHubGitLabOktaDatadogMongoDB Atlas
Live today: AWS and GitHub. Next: GCP, Azure, GitLab, Okta, Datadog and MongoDB Atlas.
No AI decides what's wrong. Rules do, and you can read them.
The vision · four levels, and the AI you talk to
The vision: four levels, and the AI you talk to
Each level asks for more permission than the last, and you grant them one at a time.
Guard
The bad change is flagged before it lands.
The same check, run on your pull requests, so a risky change is flagged before it's merged.
NeedsRead, plus posting a check on your contract repository
● Shipped · 53 of 78 resource types
Fix
What drifted goes back to what you declared.
When something drifts, AXON puts it back the way you declared it, after you approve.
NeedsWrite on the cloud, limited to what you grant
● Shipped on S3, IAM and EC2/VPC · 63 field-level fixes across 24 resource types
Operate
The day-to-day, done: build, deploy, patch, rotate.
Creating and changing things from what you declared, each step approved by a person.
NeedsWrite on the cloud — it can create and destroy, not only restore
● Shipped on S3 buckets only · 1 of 78 types
gold — built and running today; the line under each name says how farbone — designed or planned, not builtthe first four are levels you grant one at a time; Advise is the AI you talk to, and can do only what the level beneath it allows
The end state, and how it is reached
Autonomy is earned, not switched on.
TodayIt watchesRead-only. AXON proves what is running, under a role that can only read.
TodayIt proposesA prepared pull request. A human reads it, and a human merges it.
Today, where you grant itIt acts when you approveOne click, under a separate write role you create, for the resource types you allow. Read back from AWS and ledgered; a fix can be undone. S3, IAM and EC2/VPC settings so far.
Not built · the sentence the product is building toward
“You have approved this exact fix 47 times and never disputed it. Let AXON handle it from now on?”
Action without a click is not built, and stays off until your own recorded history earns it. A competitor who didn't keep the record cannot fake that history.
In the end, cloud operations is something you grant — not something you staff.
Why it gets better with time
The record is the advantage.
Cannot be back-filled
To answer what your cloud looked like on a past date, the record had to be written at the time. A competitor can ship a change feed tomorrow. It cannot ship the months AXON has already recorded for you.
Gets more valuable daily
Every scan deepens the history that audits, guardrails, remediation and day-to-day operation all draw from. One record; each level is a new way to use it.
- seq 0genesissystemorg createdprev…hash…
- seq 1provider.connectedyou@aws · role arn:aws:iam::4471…:role/axon-readprev…hash…
- seq 2repo.connectedyou@git · contracts/production.cueprev…hash…
- seq 3contract.compiledyou@prev…hash…
- seq 4scan.completedsystems3.bucket · 48 read · completeprev…hash…
A hash chain is tamper-evident, not tamper-proof.
It proves the record moved to anyone who wrote down a hash earlier. It cannot prove we did not rewrite the whole thing, because anything holding our own credentials could recompute every hash exactly as that button just did. Closing that means publishing the chain head somewhere we do not control — in the design, not yet in the code.
Where we actually are · 29 October 2026
Where we actually are
Early, and in the open. AXON runs against a real AWS account today, and every capability on this page says how far it reaches: on how many resource types, and what is not built.
No customers yet — AXON is in early access.
Every capability claim and adapter on this page is checked against our repository before a deploy. It has caught us overstating, and understating, more than once. A company selling proof should be able to prove its own claims.
- Chain verified
- intact · 173 entries
- Period
- 25 – 27 August 2026
- Controls in the pack
- 9 · SOC 2, two with violations observed
- Coverage
- every segment completed, disclosed
- Resource types AXON reads
- 77 · 20 services
- Who changed it in AWS
- not read · CloudTrail absent
- This copy's hashes
- from the original · do not re-verify here
And what does not exist.
Outside anchoring of the record
Designed, not built. See the note on the record above.
Early access · design partners
Talk to us about your AWS.
Tell us what you run and what you are audited for. We will tell you plainly whether AXON can see it yet.
Early access · looking for 3 design partners
or email hello@artinhum.com