Case Study · TEE Infrastructure
ZeroCopy Systems:
sovereign signing infrastructure
AWS KMS adds 130ms per signing operation. That's not a performance problem. That's a business problem when your fund executes 10,000 trades per day and each one waits on a network round-trip to a key management service you don't control.
The situation
The status quo for institutional key management is KMS or CloudHSM. KMS adds 130ms. CloudHSM brings it to 5ms. Both require a network round-trip to a service you don't control, and both are black boxes. You can't inspect what happens inside.
For AI agent platforms, the stakes are different. An agent that can sign transactions autonomously, without hardware-enforced policy controls, is a liability item. Not a product feature. Regulators want evidence of guardrails. Investors want to know the blast radius if an agent misbehaves.
The question was whether hardware-verified signing at sub-millisecond latency was achievable without a dedicated HSM vendor. AWS Nitro Enclaves answered yes. The question was how.
The build
I built ZeroCopy from scratch in Rust. The architecture is layered: a Nitro enclave at the core (isolated compute, no persistent storage, hardware-attested), a policy engine above it (rules, circuit breakers, per-agent limits), and a custody layer managing the split between hot active keys and cold storage.
The enclave itself runs in a stripped environment. No network access, no filesystem write, no external dependencies. Signing happens inside the enclave with the key never leaving hardware boundaries. The attestation document cryptographically proves the enclave code hasn't been tampered with.
The policy engine enforces limits deterministically: max drawdown, position limits, forbidden commands. These aren't configuration files. They're enforced at the hardware boundary. An agent cannot bypass them by modifying its own prompt or memory state.
Outcomes
What this means for a client
This is the implementation reference. If you need a TEE signing system, I've already built one. The architecture decisions have been made, the failure modes have been found, the security model has been stress-tested. You're not paying for discovery. You're paying for the first engineer who's already done it.
The same pattern applies to policy enforcement for AI agents. The mission file structure, the BDI goal engine, the circuit breaker. All of it exists as working code, not as a design proposal.
If you're building this