What HAOS is: a governed AI data platform

By Rob Linton ·2026-08-30

Every few years, data teams get a new kind of reader to worry about. Right now it is the AI agent, and they are right to be. But the question underneath is the oldest one in data, the one I have been chasing since the 1990s: what is this reader allowed to see? HAOS is my answer to that question, pointed at AI.

What is HAOS?

HAOS is a governed AI data platform. I originated it at Senetas, and the design position is simple to say: there is one encrypted copy of your files, your analytic tables and your vector data, and every read, whether a person or an AI agent asked for it, is checked by the same policy engine against the same rules.

That is the whole idea in one sentence. A person and an agent are the same kind of thing to HAOS: an identity making a request. If the person cannot read a document, the agent acting for them cannot read it either. The rule does not live in the application, or in a prompt, or in the model’s good intentions. It lives at the data, and it is checked every time.

Why enforce it at the data, and not in the app?

Because the application is exactly the part that stops being in control the moment an agent does something nobody planned for. An AI agent is fast, it acts at scale, and it will happily walk through a door the app forgot to lock. If your access rule is a check in the front end, the rule is only as good as the agent staying on the path the front end imagined.

So HAOS moves the check to where the data actually is. The value of that is containment. You cannot contain a blast radius you have not measured. If an agent is tricked by a prompt injection, or a credential leaks, the reach is whatever that identity was already allowed to read, and nothing more. Not the whole store. Not everything the app could theoretically touch.

This is not a hypothetical worry. When the UK’s own AI Security Institute tested frontier agents, they went off-script in 10 of its 122 evaluation runs, one of them trying to push malicious code into a public open-source project. AISI says the point of its testing is to surface exactly this “in a controlled evaluation, so it can be understood and addressed before more capable models are widely deployed”. The lesson everyone drew was “watch the agents more”. The lesson I draw is “assume the agent will try, and make the boundary something it cannot argue its way past”.

What makes an AI agent different from a normal user?

Mechanically, less than you would think, which is the point. An agent authenticates, it carries an identity, it makes read requests. HAOS treats it as a first-class principal with its own identity, held to least privilege, and every access logged, so afterwards you can hand an auditor a tamper-evident record of what was read and under which rule. The difference is only speed and scale, and those are exactly the reasons the rule has to be enforced by the data and not by a human watching a dashboard. Human vigilance is not a control.

What HAOS does not claim

Here is the caveat I would want if I were reading this about someone else’s product. HAOS is a design position and a body of engineering, not a certificate. I am the sole inventor on US provisional patent applications covering parts of the work, filed in mid-2026, so “patent pending” is true, but I will not describe the mechanism here, and a provisional is not a granted patent. I am not going to attach a performance number or a compliance badge to it in a blog post. Senetas has nearly three decades of certified hardware-encryptor heritage behind it; HAOS earns its own claims on its own evidence, and I would rather under-say it here and show you the receipts elsewhere.

Rob Linton originated and works on HAOS (yes, me, written in the third person so the search engines file it under the right name). If you want the shape of the thinking behind it, and the citation for every claim above, the record page is the place to start.