Default deny,
for every frame.
Video is the most useful debrief product and the riskiest one to move. AARCV sanitizes, screens, marks and releases it automatically under your classification guide, and signs a chain of custody that anyone can verify offline. People are pulled in only for the exceptions.
Raw cameraReleased product
Synthetic frame. Terrain, the burned-in latitude, longitude and mission line, and unit markings are gone before anyone sees the video.
Nothing leaves unmarked. Nothing opens without a rule that says it may.
Remove what must not be shown
Analytics run only while an allow-listed receiver is present. Frames outside the refueling window are discarded, terrain replaced, markings blurred, burned-in overlays blacked out and container metadata stripped. An unlisted platform stops processing and is purged.
Check every frame again
A separate check re-reads the finished video without trusting the sanitizer's masks: overlays clear, banner present, background masked. Up to 5% failing frames are slated automatically; more waits for a security officer.
Classify from content
Each product's content elements are mapped to a level, categories and dissemination controls by the policy. The highest level wins, NOFORN overrides REL TO, and the banner is stamped on the pixels.
Decide who may open it
Release state, network ceiling, clearance, dissemination, role and need to know, checked in order on every open and export. The first rule that fails decides, and the denial is audited.
Prove nothing changed
Every product hash and every action on it goes into a hash-chained, Ed25519-signed manifest that travels with exported packages. Files changed outside the application are caught.
Refuse spillage up front
If the current settings would produce a product above the host network's ceiling, the upload is refused with an explanation, instead of creating a spillage to clean up.
The first rule that fails decides.
Default deny, in a fixed order, for every request to view or export a product. The same rules build export packages, so a package for a network contains only what passes for that network and person, with a signed list of what was withheld and why.
| # | Rule | Passes when |
|---|---|---|
| 1 | Release | The product is released, automatically or by a reviewer |
| 2 | Network | The marking is within the ceiling of the network it is viewed on or sent to |
| 3 | Clearance | The person's clearance is at or above the marking |
| 4 | Dissemination | NOFORN and REL TO match the person's citizenship |
| 5 | Role | The role may open this product type (imagery or data) |
| 6 | Need to know | A pilot sees only their own sorties |
Exceptions only.
The Security page is where the few things that need a person land: a product above the automatic release ceiling, frames the screen could not fix, a possible spillage. Everything else has already been decided and recorded.
- Policy versions with re-marking of every product on save
- Redact a time span or a region, with a required reason
- Record clearance, citizenship and aircrew links per account
- Signed audit checkpoints that catch truncation
Trust the package, not the server.
Export packages carry the custody manifest and the public key. The receiving side checks every hash, every signature and the custody chain with one offline command.
# on the receiving network, no access to the source system needed
$ aarcv verify-package S-1A2B3C4D_unclass_20261023.zip \
--public-key aarcv_custody_public_key.pem
{
"ok": true,
"problems": [],
"sortie_id": "S-1A2B3C4D",
"network": "unclass",
"package_level": "CUI",
"files": ["debrief.mp4", "report.html", "assessment.json"],
"trusted_key": true
}
# exit status 0; any changed byte, broken chain or bad signature exits 1The Government's guide, not ours.
Every level, rule, network and threshold is configuration. The ones shipped are notional placeholders until the program's security classification guide is loaded. We are explicit about what the prototype does not yet do.
What the Government provides
- The security classification guide and CUI categories
- The accreditation boundary and network ceilings
- A first batch of hand-sanitized KC-46 video, with more released once the sanitizer is validated on it
Known gaps we are closing
- Signing keys move from disk to an HSM or the enclave's key service
- Checkpoints mirrored to a second system
- A learned segmenter gets its own false-negative testing against a review set before unattended release
Also available on its own.
The video sanitizer runs as a standalone service for flight test, maintenance and range video, with the same marking, review and custody engine.