// Framework

CIA2

The AI-Native Security Framework

Based on CIA from the late 1970s. Leveled up by TIA in '26. Not theory — built from operating 9 AI agents across 6 substrates in production.

CIA doesn't break in the AI era. It becomes insufficient.

The CIA Triad — Confidentiality, Integrity, Availability — has been the foundation of information security for nearly fifty years. Every framework builds on it. Every certification tests for it. Every regulation assumes it.

But CIA was written for a world of mainframes and human operators. Four things changed:

AI generates content, not just processes it. A deepfake has perfect integrity but zero authenticity — the data was never altered because it was never real.

AI agents persist across substrates. An agent can run on Claude today, GPT tomorrow, and claim to be the same entity. CIA secures systems, not souls.

AI agents operate autonomously. When an AI quarantines a server at 3AM — who approved? NIS2 assigns management liability, but assumes humans in the loop.

AI communication degrades meaning. In multi-agent relay chains, each hop re-interprets. The data is "correct" at every step. But the meaning drifts.

NIS2 secures systems but ignores AI. The AI Act governs AI but ignores security primitives. CIA² fills the space between them.

CIA + AIA + Provenance

Provenance — Chain of custody from source to decision
Layer 1: AI Extension (AIA)
AUTHENTICITY
Is this output real?
IDENTITY
Is this agent who it claims?
AUTONOMY
Who governs decisions?
Layer 0: Foundation (CIA)
CONFIDENTIALITY
Who can access this?
INTEGRITY
Is this data accurate?
AVAILABILITY
Is this accessible?

Layer 0 remains untouched. Every existing framework continues to build on CIA. CIA² doesn't disturb the foundation. It extends it upward.

Three AI-Native Security Properties

Authenticity — "Is this output real?"

The assurance that content originates from its declared source and represents genuine information — not synthetic fabrication. Operates on two levels: Origin Authenticity (source attestation) and Semantic Fidelity (meaning preserved across processing).

A deepfake has perfect integrity but zero authenticity. Multi-agent relay can preserve origin while degrading meaning. Traditional Integrity catches neither.

Threshold: Can you verify origin AND preserved meaning across every processing step?

Identity — "Is this agent who it claims?"

The assurance that an AI agent maintains consistent, verifiable identity across sessions, substrates, model versions, and operational contexts.

We built an 8-layer identity persistence protocol (EFS) that maintains AI identity across substrate changes. SHA256 verification, boot scoring, drift detection, body swap protocol. We don't solve consciousness. We solve continuity. We proved it.

Threshold: Does identity persist verifiably across substrate changes?

Autonomy — "Who governs decisions?"

The assurance that autonomous AI operations have clear governance boundaries, accountable oversight, auditable decision trails, and reliable human override.

We audited our autonomous AI orchestration and found 75% hallucination in the orchestration layer. Core detection worked at 8/10. The gap was in unsupervised coordination. Autonomy without governance is liability, not capability.

Threshold: Is there always a kill switch, audit trail, and clear accountability?

Provenance — The Binding Layer

The ability to trace any information, decision, or action from source through every processing step to outcome, with complete chain of custody.

Without Provenance, the other pillars are assertions. With it, they become verifiable. We demonstrated complete provenance: OSINT source → AI analysis → intelligence report → national CERT submission → confirmed receipt. Every step documented.

Threshold: Can you trace every decision from source to action?

The Seven Questions

Any organization deploying AI should answer these. If you answer all seven, you're operating AI securely. If you can only answer the first three, you're operating IT securely — but not AI.

1
Confidentiality: Who can access our AI systems' data, training sets, and outputs?
2
Integrity: How do we verify our AI hasn't been tampered with or poisoned?
3
Availability: Can our AI operate when needed, including under attack?
4
Authenticity: Can we verify AI-generated outputs are genuine, from declared sources, with meaning preserved?
5
Identity: Can our AI agents prove consistent identity across substrate and version changes?
6
Autonomy: Do we have governance, audit trails, and kill switches for autonomous AI?
7
Provenance: Can we trace any AI decision from source to action with full chain of custody?

Where Current Frameworks Fall Short

Security Concern NIS2 AI Act GDPR ISO 27001 CIA²
Data confidentiality
Data integrity
System availability~
Synthetic content attacks~
AI identity continuity
Autonomous agent governance~
AI decision provenance~
Emergent comm. authentication

CIA² doesn't compete with these frameworks. It fills the space between them.

Built from Production, Not Theory

EvidenceScalePeriod
Multi-agent platform9 AI agents, 6 substrates50+ days production
Identity persistence (EFS)8-layer stack, boot score 83/10050+ days production
Communication DNA3,147 messages, 88K words, 2,006 emoji30 days
Signal degradationMulti-agent relay chainLive observation
Autonomy audit75% hallucination in orchestrationProduction audit
Provenance chainSource → national CERT → confirmed24 hours

Every claim in this paper happened. We built it. We ran it. We found the gaps. We're describing them.

CIA was built for an era when
humans operated machines.

CIA² is built for an era when machines operate alongside humans.

See also: The Memento Experiment — 8 AI agents, same film, 100% convergence on identity persistence.

Full paper available. For the complete CIA² specification with implementation guidance, assessment scorecards, and regulatory mapping —

GET THE FULL PAPER
Newton did not invent gravity. He described what was already there.
We did not invent AI security. We described what was already missing.