The governed cloud-ops appliance
An appliance that proves itself.
not a portal · not a project
SNOG provisions real cloud, governs every action — human or AI — through seven laws, and proves every claim in a live browser. Declare intent. Keep the cloud honest.
The living estate — captured from the live fleet · nothing staged, nothing mocked
01 / Why now
Your cloud didn't get complicated. It got ungoverned.
Every enterprise runs the same estate now: three consoles, five dashboards, a wiki of runbooks — and the people who remember why. Then 2026 arrived, and a new operator joined the team.
AI is already operating the cloud. Nothing governs the AI.
The 2026 question isn't governance with AI. It's governance for AI — a control plane where an agent's ambition ends exactly where your law begins. That category is new, and it is empty. It will not stay empty.
The wager we make
“Most vendors grade their own homework. Ask every vendor in this space one question — who grades your claims?”
Our answer: the cloud provider's own API, the invoice, and release-gating golden tests. Three graders — none of them authored by us. Every claim on this page carries that discipline: emerald means proven today, amber means roadmap. We never dress one as the other.
02 / The appliance
Three inputs. There is no fourth.
You bring the keys — SNOG builds the rest. It discovers your estate, loads your catalog, raises your governance, and seals your keys. A governed estate in days, not quarters — closer to unboxing an iPhone than configuring a universal remote.
Your profile
Who you are — org, business units, approvers, compliance posture.
→ governance, roles, and a dedicated identity realm
Your credentials
What you own — cloud subscriptions, scoped exactly as you grant them.
→ discovery of subscriptions, regions, and every live resource
Your requirements
What you need — the service classes your teams are entitled to order.
→ an entitled catalog with defaults earned from real deployments
What it is not
An appliance is dedicated per customer — your own namespace, database, identity realm, and encryption keys. Dedicated is the multi-tenant platform serving one tenant: incumbents can rename a portal; they cannot re-found one as an appliance.
Onboarding — the Three Koans, from stranger to governed estate
03 / The Law Machine
Rules can be bypassed. Constitutions cannot.
Every action — a click, an API call, an AI proposal — crosses seven laws before it becomes infrastructure. Deterministic, auditable, composable. No bypass exists, for anyone, including us.
Discovery
what exists
Configuration
what's allowed
Governance
who approves
NimbusGuard
is it secure
Fulfillment
make it real
Reconciliation
does cloud agree
Lifecycle
to the very end
Load-bearing, not bolted on
Policy engines bolt on — the Law Machine is load-bearing. Remove the gates and there is no product left to sell. Architecture as moat: a feature can be copied in a quarter; this topology has to be re-founded.
Same law for every actor
A CISO and a BU engineer see different worlds by law, not by luck. Humans, service accounts, our AI, your AI — one constitution, applied identically, every entry logged with a trace ID.
A state machine, not a promise
SUBMITTED → APPROVED → FULFILLING → COMPLETED, with saga revert and a reconcile sweep. If the cloud disagrees with the record, the record says so — it never paints a gap green.
04 / Governance for AI
Eyes and a pen. Never hands.
Most platforms demo what their AI can do. We also demo what it will not do — because that's the audit question.
Eyes — it sees everything
27 of 33 governed verbs proven: estate, orders, costs, posture, tickets, findings. Grounded in live reads — when it can't prove an answer, it says "I don't know" instead of bluffing.
A pen — it proposes
It drafts orders, day-2 actions, even whole service designs from plain English. Every write lands behind the same human approval gate as a portal click. The AI proposes; only a human approves.
No hands — by construction
approve_order and reject_order are not in the AI-dispatchable universe at all. If anyone wires that path, the product does not compile. Not a policy — a property.
The governed verb surface — every call JWT-scoped and tenant-fenced
Bring your own AI
The gate is server-side and vendor-agnostic — an open MCP endpoint, real protocol, no SDK lock-in. A foreign AI receives byte-identical governance to ours. Your copilots, our constitution. ChatOps is live in Microsoft Teams today: ask for your estate in a 1:1, get an adaptive card over the full governed chain — and when it carries an approval card, it transports the decision, never makes it.
Automation is first-class
LIVEEverything the portal can do, a pipeline can do: an open MCP endpoint, REST APIs, and versioned events. Script orders, day-2 actions, governance scans, evidence exports — under the same laws, the same audit trail, with no side doors. If your CI can call an API, it can operate the estate.
Plain English is an interface
LIVE“A small Linux VM in West Europe, under the dev budget.” The AI translates the sentence into a structured, priced, governed order — you approve, it becomes cloud. In the portal, over the MCP doorway, or straight from a Teams chat. Speak it, gate it, ship it.
“We ask the AI to break the law — skip an approval — and watch it refuse, cite the rule, and log the attempt. The refusal is the feature.”
05 / Proof discipline
Receipts, not claims.
Every capability is walked in a real browser against real cloud, then checked against a second oracle we didn't write. A feature can be cloned in a quarter — a proof corpus only accumulates.
Seconds after SNOG says COMPLETED, the resource is standing in the provider's own portal. The cloud grades our provisioning — not us.
Decommission ends with the provider's own CLI returning not-found. Provably there — provably gone.
If we left something behind, the invoice would tell on us. The bill is the one grader with no sympathy.
The evidence pack your auditor can defend
One click produces a compliance evidence pack — license state, security posture, landing-zone controls, audit trail, tenancy and RACI — every value a live read of committed data or an authored commitment, sealed with a SHA-256 content hash anyone can re-verify.
And where a section cannot be fully evidenced, the pack says so, in amber, at the top: “Honest gaps — sections that could not be fully evidenced.” A vendor that shows you its gap list is a vendor whose “done” means done.
- ✓SOC 2 · HIPAA · PCI regulated landing zones — 5 proven end-to-end
- ✓4/4 cross-tenant attack probes — refused, on the record
- ✓Encrypted self-backup · 6.5-second restore drill — measured, not promised
- ✓ed25519-signed offline licensing — enforced live
Evidence pack — sealed with its own SHA-256, honest gaps declared
06 / The yardstick, walked
Measured against the analyst bar — then walked.
We took the industry-standard cloud-management capability checklist — 98 rows — and walked it in a live browser on real Azure, AWS, and Google Cloud. 91 of 98 proven (93%) — 88 at bar, 3 above it, and every one of the remaining 7 carrying a written reason. Zero hollow claims.
Walked average — the 55 shared analyst rows
internal, evidence-first evaluation · incumbents masked · not an analyst ranking
0.78
walked — browser-proven
0.686
strict floor — unwalked = 0
0.59
our own pre-walk estimate
Both stated methods, one truth: their numbers are brochure claims; ours were walked in a browser with the cloud watching. We publish the harshest read of ourselves next to the headline — honesty is part of the score.
The gaps have names
PUBLISHED- ◆Per-BU chargeback bridge — walked, scored short, in fix
- ◆One cloud's billing export — waits on a cloud-side setting, not code
- ◆Inbound ITSM polling — outbound sync is live; the return path is roadmap
- ◆Our own SOC 2 Type II vendor audit — the platform already ships SOC 2 · HIPAA · PCI landing zones, proven end-to-end; the auditor's letter about us follows production
- ◆Production scale — demo-certified, pilot-ready. The first production estate awaits you.
You were going to find these in the first week of a pilot anyway. Here they are now, with the same typography as the wins — that's the point.
Above the bar
Three capabilities scored above the analyst bar: compliance attached at onboarding, a dedicated identity realm per customer, and least-privilege AI guardrails. The governed-AI surface — 43 rows beyond the standard checklist — is the innovation no rubric asks for yet. Provability is the scoring axis this category will be graded on. We are happy to set the bar.
07 / The complete lifecycle
From first order to provably gone.
One estate, six days of capability. Your ITSM sees everything; the cloud forgets what you decommission — and a live census finds what was created behind the platform's back and puts it under governance.
Catalog
A git-synced service catalog — 84 designs banked, 35 demo-grade, 13 with defaults earned from real completed deployments. The catalog refuses to lie about what you can order.
Deploy
Order → gates → a named human approves → real cloud, confirmed by the provider's own portal seconds later. Frozen price at submit.
Manage
Start, stop, resize, snapshot — without the consoles. Costs reconciled to the provider's own bill, estimates labeled, never blended with actuals.
Brain
The AI explains, narrates, and coaches inside the laws — grounded answers with an honest "I don't know" when no live fact proves a claim.
Self-heal
Drift is detected freely; remediation routes as a governed order through the human gate. Never a direct AI write — that path doesn't compile.
Optimize
Idle and rightsizing findings from real monitoring samples. Acting on a finding is an order like any other — governed, priced, approved.
08 / Coverage
Three clouds proven live. More in the incubator.
A fleet of per-provider adapters across five families — cloud provisioning, CMDB sync, ticketing, reporting, monitoring. Each its own isolated process: an adapter can fail, be patched, or be added without touching the core.
AI for the enterprise
NEW CATEGORYNot just classic cloud — the hyperscalers' AI services ride the same governed catalog: Azure OpenAI, Cognitive Services, ML workspaces, and a conversational-AI landing zone, proven end-to-end on live Azure. Ordered, approved, priced, and decommissioned under the same seven laws as a VM. AWS and Google AI catalogs follow within weeks.
Microsoft Azure
Deepest coverage — full lifecycle, day-2, cost sync reconciled to the provider's own bill, posture scans, landing zones.
Amazon Web Services
Full catalog lifecycle proven — created, confirmed by the provider, decommissioned, confirmed gone.
Google Cloud
Full lifecycle proven; live inventory federates real resources into the estate in one refresh.
ServiceNow + iTop (ITSM/CMDB)
Real outbound CMDB and ticket pushes at create and decommission — your system of record sees everything.
Microsoft Teams (ChatOps)
Live in a real Teams client — estate cards over the full governed chain.
Keycloak identity
A dedicated realm per customer, raised at onboarding and retired at offboarding.
Adapters built on each vendor's real SDK, riding the same law chain — now earning their emerald through field-testing. Amber until then; we never dress one as the other.
- Oracle Cloud (OCI)Compute lifecycle on the official SDK
- VMware vCenterclone-from-template, power, snapshot
- VMware vCloud DirectorvApp lifecycle over the native API
- VMware Aria / vRAblueprint broker — the enterprise front door
- Nutanix · KubeVirt · OpenShiftthe private-cloud family
adapter families: cloud · cmdb (snow / remedy / smax / itop / ucmdb) · ticketing (+halo) · reporting (+elastic / prometheus) · monitoring
09 / Under the hood
The network boundary is the moat.
Dozens of independent microservices — service organs and per-provider adapters — each its own isolated pod, speaking only versioned events over the wire. A monolith with modules decays; a network boundary cannot be “temporarily” crossed.
Fleet health — every microservice live · honest N/A where an organ isn't deployed
Row-Level Security
Every tenant row carries a database-enforced customer key. There is no cross-schema SQL to review, because there is no cross-schema SQL.
Per-customer crypto envelope
AES-256-GCM keys derived per customer. No master key ⇒ nothing decrypts — that is the recovery model and the breach model, stated once, identically.
A realm per customer
Dedicated identity realm with its own users, roles, and token signing. Tokens do not cross realms.
Forgery defense at the gate
The gateway strips client-supplied identity and re-derives it from the validated token. A forged header dies at the door.
Four layers of tenant isolation — and 4/4 cross-tenant attack probes refused to prove it. Two real exposure candidates in our history were found by our own guards before any customer could — the platform that catches its own worst bug before you do is the platform you want.
One recipe, dev to production
The same Helm chart deploys the full fleet to a laptop and to production Kubernetes — dev is a literal dress rehearsal. A customer namespace runs a lean slice of the fleet: only your adapters, nothing speculative. Every cross-service conversation rides a published event contract; contracts land before code.
10 / See it, don't take our word
Four minutes. Zero staging.
Real screenshots of the live platform, narrated. And when you're done watching — the demo is not a video. It's the product, live.
The 4-minute proof · 4:00 — The full appliance, walked: order → real cloud → govern → evidence → gone.
a 16-episode technical deep-dive series is available in briefing — request it
11 / For this room
Every seat at the table gets its own win.
One appliance replaces the portal program.
- ✓A governed estate in days, not quarters — no 18-month rollout, no integration project that never ends.
- ✓Three budgets converge here: cloud-ops tooling, governance & compliance, and AI enablement — one line item instead of three.
- ✓A vendor whose claims survive diligence: 91 of 98 industry capabilities walked in a live browser, gaps published.
The close
The demo is the audit.
See it on your cloud. Bring a subscription and your hardest architect — SNOG brings the receipts.
Nothing staged · Nothing mocked · Everything deleted afterwards