Project Trident

Project Trident is ACES's three-tier enclave, built once and sold repeatedly. Every tier adds capability without rebuilding what came before it.

Tier 1: Core Enclave

The core enclave is the committed floor for every deployment. It stands up a compute, identity, and audit evidence baseline mapped to a named set of NIST SP 800-171 controls, validated by four independent static analysis tools before anything deploys, and continuously checked against AWS Config's own compliance rule set after deployment.

This baseline only grows. A customer's own architecture decisions may add controls to it. Nothing in the pipeline is permitted to quietly remove a control from the committed floor without a new, signed decision record.

Tier 2: Container/Kubernetes Security Hardening

Tier 2 is a pre-built, pre-evidenced catalog module, activated for a customer's workload rather than built unconditionally for every deployment.

Tier 3: Enterprise Control Plane

Tier 3 extends the enclave to enterprise-scale control and oversight.

Compare tiers

Comparison of ACES Project Trident tiers: Core Enclave, Container/Kubernetes Security Hardening, and Enterprise Control Plane, by feature.
Feature	Tier 1Core EnclaveThe committed floor for every deployment.Not publicly priced — contact usContact us about Tier 1	Tier 2Container/Kubernetes Security HardeningA pre-built, pre-evidenced module, activated for your workload.Not publicly priced — contact usContact us about Tier 2	Tier 3Enterprise Control PlaneExtends the enclave to enterprise-scale control and oversight.Not publicly priced — contact usContact us about Tier 3
Compute and identity
Compute, identity, and audit evidence baselineThe core enclave's committed floor. This baseline only grows — a customer's own ADRs may add controls to it, and nothing in the pipeline may quietly remove a control without a new, signed decision record.	Included	Partial — Container and Kubernetes security hardening, workload-activated.	Not included
Evidence and audit
Mapped to a named set of NIST SP 800-171 controls	Included	Partial — Container and Kubernetes security hardening, workload-activated.	Not included
Validation
Validated by four independent static analysis tools before deployment	Included	Partial — Container and Kubernetes security hardening, workload-activated.	Not included
Continuously checked against AWS Config's compliance rule set	Included	Partial — Container and Kubernetes security hardening, workload-activated.	Not included

Tier 1Core EnclaveThe committed floor for every deployment.Not publicly priced — contact usContact us about Tier 1

Compute, identity, and audit evidence baseline: The core enclave's committed floor. This baseline only grows — a customer's own ADRs may add controls to it, and nothing in the pipeline may quietly remove a control without a new, signed decision record.; Included
Mapped to a named set of NIST SP 800-171 controls: Included
Validated by four independent static analysis tools before deployment: Included
Continuously checked against AWS Config's compliance rule set: Included

Tier 2Container/Kubernetes Security HardeningA pre-built, pre-evidenced module, activated for your workload.Not publicly priced — contact usContact us about Tier 2

Compute, identity, and audit evidence baseline: The core enclave's committed floor. This baseline only grows — a customer's own ADRs may add controls to it, and nothing in the pipeline may quietly remove a control without a new, signed decision record.; Partial — Container and Kubernetes security hardening, workload-activated.
Mapped to a named set of NIST SP 800-171 controls: Partial — Container and Kubernetes security hardening, workload-activated.
Validated by four independent static analysis tools before deployment: Partial — Container and Kubernetes security hardening, workload-activated.
Continuously checked against AWS Config's compliance rule set: Partial — Container and Kubernetes security hardening, workload-activated.

Tier 3Enterprise Control PlaneExtends the enclave to enterprise-scale control and oversight.Not publicly priced — contact usContact us about Tier 3

Compute, identity, and audit evidence baseline: The core enclave's committed floor. This baseline only grows — a customer's own ADRs may add controls to it, and nothing in the pipeline may quietly remove a control without a new, signed decision record.; Not included
Mapped to a named set of NIST SP 800-171 controls: Not included
Validated by four independent static analysis tools before deployment: Not included
Continuously checked against AWS Config's compliance rule set: Not included

No standing credentials

No shared secrets sitting in a config file waiting to be stolen. Every identity in the enclave authenticates through short-lived, centrally governed access, never a long-lived access key.