# Ironwall: verification for people and AI agents

> Ironwall is the Grideōs verification layer for people and AI agents. A device's secure hardware signs a one-time challenge, that attestation becomes a 128-byte zero-knowledge proof, and a verifier at the network edge checks it in 8.6 ms before the request goes any further. The edge verifier is live; the steps before it are published architecture.

Source: https://grideos.com/ironwall/
Publisher: Grideōs (Grideos Global Corp.), Calgary, Alberta, Canada
Updated: 2026-10-16

## Ironwall in one paragraph

Ironwall is a zero-trust verification layer built by Grideōs in Calgary for the agent internet, where both people and AI agents send requests. It works in three steps. A device's secure hardware signs a one-time challenge through WebAuthn (FIDO2), with the biometric unlock kept on the device. That attestation is turned into a Groth16 zero-knowledge proof of about 128 bytes. A WebAssembly verifier at the network edge checks the proof in 8.6 ms and either issues a narrowly scoped token or rejects the request. The edge verifier is live at [edge.grideos.com](https://edge.grideos.com); the attestation and proving steps are published architecture.

## How it works, step by step

| Step | Where | What happens | Status |
|---|---|---|---|
| 1. Attest | On the device | The device's Secure Enclave or TPM 2.0 signs a one-time challenge with a key that cannot leave the hardware, using the W3C WebAuthn and FIDO2 (CTAP2) standards. Face ID, Touch ID or Windows Hello unlocks the key locally; no biometric data is sent. | Published architecture |
| 2. Prove | Off the edge | The attestation is turned into a proof in the SP1 zkVM, which runs ordinary Rust compiled to RISC-V, then compressed from a STARK into a constant-size Groth16 proof of about 128 bytes on the BN254 curve. Its public inputs include a nonce, a timestamp and a hash of the attestation. | Published architecture |
| 3. Verify | At the network edge | A #![no_std] Rust module compiled to WebAssembly checks the proof inside a Cloudflare Workers isolate. A valid, fresh proof receives a tightly scoped JWT; anything else is rejected with a 401. Proofs older than 500 ms are refused, and so are nonces the same verifier instance has already seen. | Live at edge.grideos.com |

Steps 1 and 2 are described in the zk-circuit-challenge repository; their source code is not public. Step 3 is live, and the verifier module's source code is public; the deployed build is not yet tied to a published commit.

## What is live, and what is published

| Part | Status | Check it |
|---|---|---|
| Edge verifier: Groth16 over BN254, in WebAssembly | Live. Anyone can send it a request. | [edge.grideos.com](https://edge.grideos.com) |
| Verifier source code | Public, MIT licence | [ironwall-verifier](https://github.com/GrideosGlobal/ironwall-verifier) |
| Verification in 8.6 ms, a 381 KB binary, a warm round trip of about 123 ms, invalid proofs rejected in about 76 ms | Measured by Grideōs and published on 8 April 2026; not independently validated | [ironwall-edge-bench](https://github.com/GrideosGlobal/ironwall-edge-bench) |
| Device attestation and proof generation | Published architecture, open for review; source code not public | [zk-circuit-challenge](https://github.com/GrideosGlobal/zk-circuit-challenge) |
| Replay protection: a 500 ms window and a nonce check, kept in memory by each verifier instance in the current version | Stated; outsiders cannot test it without a valid proof | [Proof page](https://grideos.com/proof/#verifier) |

## What Ironwall does not claim

- It does not identify anyone. A valid proof shows that attested hardware signed a fresh challenge. It does not reveal who holds the device, and the verifier never sees a fingerprint, a face or a name.
- It does not defeat a compromised device. Ironwall attests that the device's hardware security module signed the challenge; it does not claim to stop kernel-level compromise of that device. Endpoint security protects the device; Ironwall protects the connection between it and the service.
- It does not make a request true. Verification shows where a request came from and that it is fresh, not that what it says is correct.
- Its numbers are its own. No independent third party has validated the performance figures yet.

## Why Ironwall does not watch how people move

Early Ironwall research tried to tell people from bots by behaviour: pointer paths, timing, scrolling and phone motion, fused into one classifier. On synthetic data it reached an AUC of 0.9982 and passed 99.6 percent of simulated people. Grideōs set it aside anyway. Motion can be imitated by capable automation; collecting it continuously is a privacy liability; and judging how someone moves disadvantages people with motor impairments. Ironwall's published architecture replaces it with cryptographic attestation, in which the biometric check stays on the device and no motion data is collected. The research, never validated on real traffic, is preserved at [kinematic-signal-research](https://github.com/GrideosGlobal/kinematic-signal-research), and the full story is in [Dispatch 010](https://grideos.com/dispatches/010-why-ironwall-stopped-watching-how-people-move).

## Where Ironwall fits in Grideōs

Grideōs builds record systems for expert work and argues that a record should be provable, not merely recorded. Ironwall is the layer designed to make that checkable: that a step was taken on real, attested hardware, at a stated time, without exposing the person who took it. It is the trust layer beneath Grideōs systems, and it is built to stand on its own wherever a service needs to know that a person or an AI agent is backed by real hardware before letting it act.

## Review it, or try to break it

The architecture is published as an open challenge. Read [zk-circuit-challenge](https://github.com/GrideosGlobal/zk-circuit-challenge) and open an issue with what you would break: the verifier on constrained edge compute, the trust assumptions of the zkVM, the limits of WebAuthn attestation, replay at global scale, the compilation chain or the choice of public inputs. To watch the live verifier reject something, send it anything that is not a valid proof:

```
head -c 256 /dev/urandom > not-a-proof.bin
curl -i -X POST https://edge.grideos.com --data-binary @not-a-proof.bin
```

More evidence, and what is not proven yet, is on the [proof page](https://grideos.com/proof/). The claims on this page are entries GRD-007, GRD-008, GRD-009 and GRD-022 to GRD-026 in the signed [facts ledger](https://grideos.com/facts/#GRD-023).

## Source code and research

- [ironwall-verifier](https://github.com/GrideosGlobal/ironwall-verifier): The Groth16 ZK-SNARK verifier that runs at the edge: #![no_std] Rust compiled to WebAssembly, BN254 curve. MIT licence.
- [ironwall-edge-bench](https://github.com/GrideosGlobal/ironwall-edge-bench): Benchmarking harness for Rust and WebAssembly latency on Cloudflare Workers. MIT licence.
- [zk-circuit-challenge](https://github.com/GrideosGlobal/zk-circuit-challenge): An open challenge: review the zero-knowledge verification architecture and tell us what you would break. MIT licence.
- [kinematic-signal-research](https://github.com/GrideosGlobal/kinematic-signal-research): Archived research on telling people from bots by behaviour, with its synthetic data generator. Kept as the record of an approach Ironwall set aside. MIT licence.