Verified identity
New accounts remain pending until their email link is successfully verified.
Security constitution
More capability should never mean less control.
Subscription never equals machine permission. LLM output never equals authorization. Customer execution never occurs inside the KING AI production plane.
Non-negotiable controls
Step-up authentication
API key and billing mutations require a recently reauthenticated session.
Asynchronous billing
Stripe webhooks are signature-checked, deduplicated and queued before entitlement reconciliation.
Immutable intelligence
Published R2 objects are content-addressed and never overwritten in place.
Producer isolation
VPS producers sign packages; replayed nonces and invalid signatures are rejected.
No command payloads
Intelligence package schema rejects arbitrary shell/SSH/execution fields.
Budget governor
Cloudflare design target ≤40%; hard software stop at 50% for nonessential workload.
Fail closed
Untrusted, stale or edge-failover data cannot silently gain automated-execution eligibility.