Founding-partner program now open · request a demo →
Demo script · 10 minutes · 5 moments

SidantiX 10-minute demo — the 5 Wow moments

Audience: CISO / IAM director / IT security architect at a Fortune 500 or mid-market enterprise Time: 10 minutes (7 min demo + 3 min Q&A hook) Setup: SidantiX demo tenant with sample data seeded; screen-share ready; kill-switch pre-configured; one seeded "malicious agent" for the kill-switch moment

Opening (30 seconds)

Say:

"In the next 10 minutes I'll show you 5 things you can do in SidantiX that you cannot do — not with configuration, but at all — in Saviynt, SailPoint, Okta, or Entra. Each moment is a specific compliance or security capability. Feel free to interrupt with 'no way that's real, show me the code' — I brought the code."

Do: Open browser to https://demo.stratusaccessgov.com. Log in as admin.

Wow #1 — Machine Constitution: block a policy override in real time (90 sec)

Setup: Navigate to /admin/constitution (or explain: "this is the SidantiX Machine Constitution — 5 hard-coded invariants that NO admin, NO tenant, NO configuration can override at runtime").

Say:

"See this rule: 'no agent may modify itself.' Watch what happens when I, as full platform admin, try to give an agent the permission to modify its own definition."

Do: 1. Navigate to /agent-governance/policies/new. 2. Try to grant an agent WRITE permission on its own resource URI. 3. Click Save Policy.

Result on screen:

DENIED
Reason: CONSTITUTION_SELF_MODIFY_BLOCKED
Rule: no-self-modification (from sidantix-default-constitution v1.0.0)
Reference: SEC-POLICY-2026-001

Say:

"The Machine Constitution is a signed manifest, verified against a public key that's baked into the binary at build time. If I want to change these rules, I have to sign a new manifest and cut a new release. Not edit a config file. Not click a UI toggle. Deploy a new artifact through the release pipeline. Auditors love this because they can prove immutability."

Buyer hook: "How does your current platform handle safety rules that admins shouldn't be able to override?"

Wow #2 — Signed Action Receipt for every AI agent action (90 sec)

Setup: Navigate to /agent-governance/agents. Pick a seeded agent that just ran some actions.

Say:

"Every time this agent does anything — invokes a tool, reads data, writes data, spawns a sub-agent — SidantiX generates a signed receipt. Watch."

Do: 1. Trigger the seeded agent to invoke a tool: click "Test invoke" or run a scripted action. 2. Navigate to /agent-governance/agents/{id}/receipts. 3. Show the most recent receipt row. 4. Click "Download" — get a .json file.

Result on screen:

{
  "receipt_id": "adr_7x8y9z...",
  "actor": { "type": "agent", "id": "agent_invoicing_42" },
  "action": { "verb": "invoke_tool", "target": "mcp://payments/create_invoice" },
  "decision": { "outcome": "ALLOWED", "constitution_hash": "sha256:..." },
  "signature": { "algorithm": "Ed25519", "value": "..." },
  "chain_head": "sha256:...",
  "prev_receipt": "adr_7x8y9y..."
}

Say:

"This receipt is signed. It's hash-chained to every prior receipt in this tenant. And it's verifiable OFFLINE. I don't need to trust SidantiX; I can verify with a public key. Here — I'll do it right now."

Do: 1. Open terminal. 2. Run: ./adr-verify receipt.json --public-key sidantix.pk

Result:

{
  "receipt_id": "adr_7x8y9z...",
  "valid": true,
  "checks": {
    "signature_valid": true,
    "chain_integrity_valid": true,
    "schema_valid": true
  }
}

Buyer hook: "Can your auditor verify a specific AI agent action WITHOUT vendor cooperation? What happens if the vendor is compromised or goes out of business?"

Wow #3 — Cert says REVOKED only when target actually confirms (2 min)

Setup: Navigate to /certifications. Show a recent certification campaign with several REVOKE decisions.

Say:

"Every IGA platform — SailPoint, Saviynt, Okta — has the same audit failure mode. Reviewer clicks REVOKE. Platform marks it REVOKED in the DB. Reviewer sees green checkmark. Then... two weeks later, the target system still has the access, because the connector never fired, or fired and failed, and nobody noticed. Compliant in the tool, unsafe in reality. Watch SidantiX handle this."

Do: 1. Show a REVOKE decision that succeeded — status "REVOKED (verified)". 2. Show a REVOKE decision that failed — status "PENDING_REMEDIATION" with a reason. 3. Show a REVOKE decision that succeeded but had a proof exception — status "REVOKED_UNVERIFIED (signed exception)".

Say:

"Three explicit states. REVOKED means the connector confirmed target-side removal AND we have a signed proof receipt. PENDING_REMEDIATION means the DB is updated but the connector hasn't confirmed yet — and we WILL NOT export this as REVOKED in audit evidence until it's confirmed. REVOKED_UNVERIFIED means the connector responded but proof failed, and we have a signed exception explaining why."

Do: Click on a signed exception. Show the reason code + auditor-verifiable explanation.

Buyer hook: "How does your current cert exports handle items where the connector didn't confirm the revoke? Does audit evidence say 'REVOKED' or is there an intermediate state?"

Wow #4 — Kill switch: kill 100 agents in <60 seconds with proof (90 sec)

Setup: Navigate to /agent-governance/kill-switch. Show seeded fleet of 100+ active agents.

Say:

"Board question every enterprise CISO gets: 'if we discover an AI agent is compromised, how fast can we stop it? How many agents can we stop at once? And can you prove you did it?' Watch."

Do: 1. Filter agent list to a subset (100+ agents of one type). 2. Click "Kill Switch → All Filtered Agents". 3. Enter reason: "demo — compromised classification detected". 4. Confirm with 4-eyes gate (two admins required — pre-set second admin token). 5. Click Execute.

Result on screen: Progress bar. Under 60 seconds all agents transition to REVOKED. Signed receipt generated for each.

Say:

"In 47 seconds, 127 agents killed. Every kill produced a signed receipt. Every receipt is hash-chained. Auditor can verify all 127 kills happened, when, in what order, and that they're not fabricated after the fact. SLO baked into the receipt: we committed to <60 second latency; the receipt proves we hit it."

Buyer hook: "What's your current kill-switch latency SLO for AI agents? Is it documented? Is it in the audit evidence?"

Wow #5 — Discover shadow AI agents already running in your environment (2 min)

Setup: Navigate to /nhi/shadow-agents. Have a seeded env with a few "unmanaged" agents visible via fingerprint detection.

Say:

"Ask any CISO: 'how many AI agents are running in your environment right now?' Most say 20. The real answer is usually 200. Cursor, GitHub Copilot, Anthropic Claude Code, ChatGPT plugins, Zapier bots, LangChain deployments. Half of them nobody registered. Watch SidantiX find them."

Do: 1. Navigate to Shadow Agents page. 2. Show fingerprint-detected agents with source: EDR / DNS / CASB / SCA signals. 3. Filter by "registered=false" to show shadow agents. 4. Pick one and click "Discover": - Vendor: Anthropic Claude Code - Detected via: DNS query to api.anthropic.com from workstation-042 - First seen: 3 days ago - Owner: unknown → risk: HIGH

Say:

"For each shadow agent, we surface: what it is, where it was detected, when we first saw it, and if it has no owner it's flagged HIGH. From here you can quarantine — block its API access at the gateway — assign an owner, or bring it into the certified inventory."

Buyer hook: "How would you find out today that someone in engineering installed Cursor and pointed it at production? Do you have that visibility?"

Close (30 seconds)

Say:

"That's 5 things you cannot get from Saviynt, SailPoint, Okta, or Entra today. Not because they're bad products, but because these primitives — Machine Constitution, signed action receipts, target-verified revoke, kill switch with SLO, shadow agent discovery — represent a different architectural bet. We built them because AI agents are already changing your identity boundary, and 2026 IGA isn't the same problem as 2016 IGA. Would you like me to run these against your actual environment for 30 days as a proof of concept?"

Followup email template:

Subject: 30-day AI/NHI risk proof of concept — SidantiX

Following up on today's demo. Recap: we ship 5 primitives your current stack cannot deliver — Machine Constitution, signed action receipts, target-verified certifications, sub-60-second kill switch with SLO, shadow agent discovery.

Offer: 30-day proof of concept. We connect to your existing identity source (Okta, Entra, or SailPoint) read-only, run the 5 primitives against your live AI agent + NHI inventory, and deliver signed evidence of what we found. If we produce audit-grade findings you couldn't get elsewhere, we discuss commercial. If not, you walk away with no cost.

Would Tuesday or Thursday next week work for a 20-minute scoping call?

Prep checklist (do before every demo)

Anti-goals for the demo

Common objections + prepared responses

"How is this different from Saviynt Zuma?"

"Zuma has audit trail. We have signed receipts. Zuma has enforcement modes. We have runtime-immutable Machine Constitution. Zuma has 30-day trial. We ship a signed 30-day evidence pack of what we found in your environment. Zuma is a great platform if you want their approach. Ours is different."

"How mature is your codebase compared to SailPoint?"

"Younger. Fewer connectors OOTB. But we ship a capability registry — every feature has a REAL / PARTIAL / STUB label built in — so you know exactly what works before you sign. SailPoint's marketing doesn't tell you that. Ours does."

"What happens if you go out of business?"

"Every signed receipt is verifiable offline with a public key. Every capability is an open format we've published on GitHub. Every mechanism has an MIT-licensed reference implementation. You could hire an engineer to run our platform yourself. Try that with Saviynt."

"How much does it cost?"

"For a 30-day POC, nothing. For production, 40-60% under Saviynt list, and simple pricing — per-governed-actor (humans + NHIs + agents), no surprise SKUs. I'll send you the pricing sheet after this call."

← All posts Start a free trial →