Decide who can see your engineering IP — person, contractor, or AI agent — before they do. Lathe gates every access to your CAD, BOM, and Program data against rules you control, and files a signed record for every decision.
Horizontal ABAC gives you a decision engine. Lathe adds the PLM vocabulary your policies actually need: Programs, parts, BOM structure, option codes, effectivity, export controls, and delegated agent access. Your team writes rules against engineering concepts instead of rebuilding the data model around every app.
Programs, option codes, BOM subgraphs, effectivity windows, ITAR markings, and part attributes — typed, queryable, versioned. Built-ins the evaluator can reason about, not strings your reviewers can typo.
Delegated identity, on-behalf-of provenance, purpose attenuation, time-boxed delegation. Every agent decision traces back to the human it served and the question they asked, without relying on shared service accounts.
Air-gapped install or customer VPC. CAD, BOM, and program data never leaves your perimeter. Built for manufacturers whose most sensitive data cannot depend on a shared cloud control plane.
Signed, immutable, schema-stable for ten years. Each record shows who asked, what they touched, which engineering attributes mattered, and why the request was allowed or denied.
Humans and AI agents are governed by the same rules and recorded against the same evidence trail. Whether the caller is an engineer at a CAD workstation or an agent reading on her behalf, Lathe knows who is asking, applies your access rules against engineering-aware policy, and files a signed record.
Engineers resolve through your existing directory groups. AI agents carry delegated identities — the human they act for, the purpose they act under, and the moment the delegation expires. No bearer-token wishful thinking, no shared service-account holes.
Your access rules reason about Programs, option codes, BOM subgraphs, effectivity windows, ITAR markings, and Joint-level attributes — not opaque strings. Bring the rules; the engineering vocabulary is built in.
Every decision is signed, immutable, and exported in the schemas auditors actually accept: NIST 800-171 control evidence, AS9100 audit packs, IATF 16949 rollups. The evidence is filed before the audit is scheduled.
Install Lathe in your VPC or on-prem. Connect it to your PLM and identity provider. Load the policy bundle that matches your stack. The first access decision is gated the same afternoon.
A minimum-shippable footprint, audited and supported. Anything beyond it appears on the public roadmap, dated and committed.
1 # Engineers read parts of their own programs,
2 # but only when ITAR clears and effectivity matches.
3 package engineering.authz
4
5 import data.programs
6
7 default allow := false
8
9 allow if {
10 input.action == "read"
11 program := programs[input.resource.program]
12 program.members[_] == input.principal.id
13 itar_ok(input.principal, input.resource)
14 effective_on(input.resource, time.now_ns())
15 }
16
17 # Agents inherit their human, attenuated by purpose.
18 allow if {
19 input.principal.kind == "agent"
20 input.principal.purpose in {"summarize", "search", "diff"}
21 not delegation_expired(input.principal)
22 allow with input.principal as input.principal.on_behalf_of
23 }Five design-partner slots open for Q3 2026, across aerospace, automotive, and medical-device manufacturing. Send a sketch of your environment: PLM stack and version, directory tenancy, and the two or three programs you'd want gated first. A pilot engineer replies within one business day. No demo gate. No marketing sequence.