JANTARSecurity, Sovereign Compliance & Command Authority
In satellite flight operations, security is a safety boundary. Jantar is built around an airgap deployment mode and a human-in-the-loop authority model, and is designed with export-control regimes in mind. The posture described here is self-attested and has not been independently audited.
ADR 0018 Command Boundary
The foundational rule: The agent layer proposes; a human authorises; one small, LLM-free, independently verified component executes. That executing component is designed, not built: Jantar ships at authority level A0 (advisory only), nothing is transmitted to a spacecraft, and an LLM must never be able to cause a transmission.
Separated Release Authority
Releasing a drafted recovery procedure requires the approver role: an operator may draft and stage but cannot release. Deployments can require two distinct approvers, and the server refuses a second approval from the same identity. The check is server-side, and the approver identity is bound to the authenticated principal — never supplied in the request body. At authority level A0 nothing is transmitted to a spacecraft. Hardware-key (FIDO2 / WebAuthn) attestation for the second signature is designed and not yet implemented.
Offline Airgap Mode
Designed for disconnected deployments. In airgap mode reasoning is deterministic (no hosted model), and every network data source is refused by an egress guard.
Sovereign Compliance & International Export Regimes
| Jurisdiction / Standard | Regulatory Scope | Jantar posture (self-attested) |
|---|---|---|
| India SCOMET Category 7 | Aerospace Systems, Spacecraft, and Launch Equipment | GKE cluster, Cloud Storage and BigQuery in Mumbai (asia-south1); requests proxied by Cloudflare; hosted-model reasoning on Vertex AI’s global endpoint, where a request may be processed in any Google Cloud region; airgap mode for disconnected deployments |
| IN-SPACe NGE Framework | Private Non-Government Entity Space Operations (India) | Registered with IN-SPACe as a Non-Government Entity; no activity authorisation held or claimed; ground-segment advisory (A0) posture; human-in-the-loop governance aligned with Indian Space Policy 2023 |
| India DPDP Act 2023 | Digital Personal Data Protection & Sovereignty | Data classification tiers defined; per-tier retention designed; per-tenant envelope encryption available as a deployment setting |
| ITAR / EAR (United States) | International Traffic in Arms & Dual-Use Controls | Airgap deployment mode with no cloud egress; deterministic local reasoning |
| 1972 UN Space Liability Convention | State & Operator Liability for Orbital Damage | Hash-chained compliance ledger and append-only investigation audit trail; grounding gates hold drafts with ungrounded steps for human approval; no commanding at A0 |
Four Data Classification Tiers (T0 to T3)
Public Data
Publicly licensed datasets and the synthetic JANTAR-REF-1 reference spacecraft. No customer nexus; licence attribution travels with the data.
Operator Data
Anything derived from or describing a customer’s spacecraft or operations. Tenant-isolated, with role-based access over OIDC.
Credentials
Credentials that grant access to systems or models. Read from the environment or a secret store at connect time, never from configuration files.
Operator Identities
Human identities in audit logs, access control and access records — the category that carries India DPDP Act 2023 obligations.