Skip to main content
Inviolet scores your program against the seven tenets of NIST SP 800-207 (Zero Trust Architecture), each measured 0–100. A tenet counts as in force once its coverage crosses θ = 60. Your position on the five-level ladder is then the highest rung where every tenet that rung requires is in force: L1 Observe → L2 Test → L3 Enforce → L4 Isolate → L5 Surround. The point of the ladder is not the number — it’s which of the five principles is in force at each rung. The levels and principles are 1:1: you climb by putting the next principle into practice, which lights up the tenets that level needs.

​
The seven tenets

Each tenet re-expresses one of NIST 800-207’s zero-trust tenets in terms of what Inviolet can actually measure. They’re listed in the order they come into force as you climb. Below its eligibility line a tenet reads N/A rather than zero — it isn’t scored or counted toward your level until the setup that makes it measurable is in place, so the onboarding view can tell you exactly what to do to start scoring it.

​
The five levels

Each level puts exactly one principle into force. They come in order — each rung assumes the ones below it are already in place.

​
Level 1 — Observe

Every prompt declares an intention and Inviolet captures it — you can see what your agents claim, and the system learns from every request. Every action still runs; nothing is blocked yet. This puts Principle 1 — learn the intent behind every prompt into force (tenets T7 intent capture and T5 monitoring).

​
Level 2 — Test

You author intent cards and policies, and they evaluate against live traffic in shadow mode. The dashboard shows what would have been denied, routed to approval, or allowed — before anything can break. This is Principle 2 — test before enforcing, which brings T4 — dynamic policy into force.

​
Level 3 — Enforce

You promote policies from shadow to live. Decisions now block real queries at the column grain, the gray zone routes to a human, and approved decisions are adopted as standing policy so the queue shrinks over time. This is Principle 3 — least access as the system learns, lighting up T3 — per-session access and T6 — strict enforcement.

​
Level 4 — Isolate

Credentials move off the agent: the vault is bound, the OAuth broker holds provider tokens, and every dispense becomes a short-lived, intention-scoped lease. The real key never reaches the agent. This is Principle 4 — agents never touch credentials, which brings T2 — secure comms into force.

​
Level 5 — Surround

Every remaining path is closed and proven: SWG egress catches direct calls, all LLM hosts are covered, traffic is fingerprinted, a bypass-test suite runs in CI, and SIEM detections watch for any attempt to route around the gateway — all attestation-grade. This is Principle 5 — impossible to bypass, which lights up the last tenet, T1 — resource coverage. Per the architecture, only Ultraviolet-tier customers can reach Level 5.

​
How your level is scored

Scoring is cumulative, not a weighted average you can game. Each tenet earns a 0–100 coverage measure; a tenet is in force once its coverage crosses θ = 60. Your level is the highest rung L for which every tenet in that level’s required set is in force — so a single lagging tenet holds you at the rung below until you lift it, and you can’t paper over it by maxing out another. Advancing a level therefore takes real coverage on the right tenets, backed by that level’s adoption checklist — concrete, checkable signals like “1+ active policy denying something,” “credential vault bound,” or “zero standing credentials” — that make each tenet measurable in the first place. So the fastest way up is to lift the specific tenet that’s holding your rung — not to over-invest in one you’ve already carried past θ.

​
Reading the dashboard’s level badge

The maturity band on your dashboard shows your current level, an N-of-7 tenets in force headline, the per-tenet coverage radar, and the next level’s outstanding tenets and checklist items. Click any item to jump to the intent card or integration that would unlock it.

​
Where to start

Most teams enter below L1 (gateway installed, no policy, no vault) and climb:
  1. Instrument a runtime and declare your first intention — makes T7 and T4 measurable and puts Principle 1 to work
  2. Assign approvers or run a policy in shadow — starts scoring T5 and crosses into L2 / Test
  3. Promote a policy out of shadow — lifts T6 and T3 and crosses into L3 / Enforce
  4. Bind the vault and broker your first provider — brings T2 into force, starting L4 / Isolate
  5. Deploy egress + bypass coverage — the last tenet, T1, and the door to L5 / Surround