The world's first cybersecurity-native programming language, purpose-built for the agentic AI era. Turn security intent into safe, verifiable execution.
ZelC separates detection logic from destructive action through a multi-layered execution model. Read-Only by Default ensures safety at compile time, not just at runtime.
Fig 1. ZelC three-layer execution model — separating intent, action, and evidence
ZelC's architecture separates detection logic from the physics of destruction through three distinct operational layers.
Before a single line of code runs, the developer or AI agent must declare an Intent — a contract that prevents hallucinations from triggering dangerous logic.
State-changing operations are strictly gated. Destructive actions like block, kill, and revoke are physically impossible unless encapsulated in a do...end block.
do...end blocks gate all kinetic verbsEvidence is a first-class citizen — not a side effect. Every action automatically records actor identity, hostname, and playbook provenance.
Every ZelC playbook goes through a five-stage compilation pipeline before a single action is taken on any live system.
Fig 2. Five-stage pre-flight compilation pipeline — from config to execution
Official FIDE Protocol — Visual Mode replaces traditional braces and end statements with icons, dropping cognitive load during a 3 AM incident.
In traditional languages, bad code fails at runtime — when the damage is already done. In ZelC, the Physics Constraint Engine catches violations during compilation, before a single API call is made.
An operator tries to terminate an AWS production backup server during a storage alert, but forgets the kinetic gate. The destructive verb sits naked in the read-only zone.
An AINA agent writes a script to isolate compromised backup servers. It correctly uses the ⚡ do block, but it hallucinates and targets the entire backup subnet — 50 servers. Your zelc.toml limits max_blast_radius = 10.
In both scenarios, the failure happens at compile-time, not runtime. This visual, math-enforced safety is what makes ZelC the only language secure enough for autonomous AI agents to operate within production environments.
Security operations must be resilient to technical failure. ZelC provides built-in primitives for graceful degradation and hard halts.
Fig 3. Resilience primitives — graceful recovery, hard halt, and tamper detection
Visual syntax extensions let operators parse a project's risk and intent at a glance. Each extension carries kinetic meaning.
A unified vocabulary for a multi-vendor world, configured via modular .toml files.
Running zelc init scaffolds the entire security operation environment. Every ZelC integration is configured via modular .toml files. These sample integration files ship with the scaffolded project and map directly to kinetic verbs in your playbooks.
Fig 4. Project scaffolding output — zelc.toml, sample integration files, and environment config
Every ZelC integration is configured via modular .toml files. These ship with the scaffolded project and map directly to kinetic verbs in your playbooks.
-- ══════════════════════════════════════════════════════════════ -- zelc.toml — ZelC Project Configuration -- Generated by: zelc init -- Documentation: https://rocheston.com/zelc -- ══════════════════════════════════════════════════════════════ [project] name = "my-soc-playbooks" version = "1.0.0" author = "Haja Mo" description = "Security automation playbooks" zelc_version = "1.2" -- ══════════════════════════════════════════════════════════════ -- SAFETY SETTINGS -- ══════════════════════════════════════════════════════════════ [safety] -- strict: kinetic verbs outside do blocks = compile error -- warn: kinetic verbs outside do blocks = warning -- off: no enforcement (not recommended) kinetic_enforcement = "strict" -- strict: tainted data in kinetic actions = compile error -- warn: tainted data in kinetic actions = warning -- off: no taint tracking taint_tracking = "warn" -- Maximum number of targets a single do block can affect -- Physics engine rejects playbooks that exceed this max_blast_radius = 10 -- ══════════════════════════════════════════════════════════════ -- INTEGRATIONS -- ══════════════════════════════════════════════════════════════ [integrations] firewall = true -- integrations/firewall.toml edr = true -- integrations/edr.toml iam = true -- integrations/iam.toml aws = true -- integrations/aws.toml azure = false -- integrations/azure.toml gcloud = false -- integrations/gcloud.toml siem = true -- integrations/siem.toml notifications = true -- integrations/notifications.toml tickets = true -- integrations/tickets.toml rosecoin = true -- integrations/rosecoin.toml aina = true -- integrations/aina.toml noodles = true -- integrations/noodles.toml vines = false -- integrations/vines.toml threat_intel = true -- integrations/threat_intel.toml docker = true -- integrations/docker.toml kubernetes = false -- integrations/kubernetes.toml github = true -- integrations/github.toml linux = true -- integrations/linux.toml dns = false -- integrations/dns.toml crypto = true -- integrations/crypto.toml rcf = true -- integrations/rcf.toml evidence = true -- integrations/evidence.toml
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: AWS -- Maps to: aws rotate, aws s3, aws ec2, aws cloudtrail, aws waf -- ══════════════════════════════════════════════════════════════ -- Authentication method -- Options: profile | env | iam_role | sso auth_method = "profile" -- ══ AUTHENTICATION ══ [credentials] -- Method 1: AWS CLI profile (recommended for local dev) profile = "soc-prod" -- ══ GENERAL SETTINGS ══ [defaults] region = "us-east-1" output_format = "json" max_retries = 3 timeout_seconds = 30 -- ══ EC2 (aws ec2 snapshot, etc.) ══ [ec2] default_vpc = "vpc-abc123" snapshot_tag_prefix = "zelc-forensic-" snapshot_retention_days = 90 -- Security group used for isolation isolation_security_group = "sg-isolate-000" -- ══ S3 (aws s3 block_public, etc.) ══ [s3] evidence_bucket = "acme-zelc-evidence" evidence_prefix = "evidence/" encryption = "AES256" -- Buckets that should never have public access removed exclude_buckets = ["acme-public-assets"] -- ══ IAM (aws rotate keys, etc.) ══ [iam] exclude_users = ["terraform-ci", "monitoring-readonly"] graceful_rotation = true notify_on_rotation = true -- ══ CLOUDTRAIL ══ [cloudtrail] trail_name = "management-trail" s3_bucket = "acme-cloudtrail-logs" enable_log_validation = true is_multi_region = true -- ══ WAF ══ [waf] web_acl_name = "production-acl" web_acl_id = "xxxx-xxxx-xxxx" ip_set_name = "zelc-blocklist" ip_set_id = "xxxx-xxxx-xxxx" scope = "REGIONAL" -- ══ GUARDDUTY ══ [guardduty] detector_id = "xxxx" auto_archive_low = true -- ══ SECURITY HUB ══ [securityhub] enabled = true standards = ["aws-foundational", "cis-aws", "pci-dss"]
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: SIEM -- Maps to: zelfire ingest, zelfire correlate -- ══════════════════════════════════════════════════════════════ -- Options: splunk | elastic | sentinel | qradar | chronicle | sumo | mock provider = "splunk" -- ══ SPLUNK ══ [splunk] api_url = "https://splunk.acme.com:8089" api_key_env = "SPLUNK_TOKEN" default_index = "security" default_sourcetype = "zelc:events" search_earliest = "-24h" search_latest = "now" -- HEC (HTTP Event Collector) for ingesting hec_url = "https://splunk.acme.com:8088" hec_token_env = "SPLUNK_HEC_TOKEN" -- ══ ELASTIC SIEM ══ [elastic] api_url = "https://elastic.acme.com:9200" api_key_env = "ELASTIC_API_KEY" index_pattern = "security-*" kibana_url = "https://kibana.acme.com:5601" -- ══ MICROSOFT SENTINEL ══ [sentinel] -- Uses azure.toml credentials workspace_id = "xxxx-xxxx-xxxx" resource_group = "soc-rg" -- ══ IBM QRADAR ══ [qradar] api_url = "https://qradar.acme.com/api" api_key_env = "QRADAR_TOKEN" version = "19.0" -- ══ GOOGLE CHRONICLE ══ [chronicle] api_url = "https://backstory.googleapis.com" -- Uses gcloud.toml credentials customer_id = "xxxx"
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: Notifications -- Maps to: notify slack, notify teams, notify email, pager trigger, webhook -- ══════════════════════════════════════════════════════════════ -- ══ SLACK ══ [slack] enabled = true bot_token_env = "SLACK_BOT_TOKEN" default_channel = "#soc-alerts" username = "ZelC SOC" icon_emoji = ":shield:" -- Channel routing by severity critical_channel = "#soc-critical" high_channel = "#soc-alerts" low_channel = "#soc-info" max_messages_per_minute = 30 -- ══ MICROSOFT TEAMS ══ [teams] enabled = false webhook_env = "TEAMS_WEBHOOK_URL" default_channel = "Security Operations" use_adaptive_cards = true -- ══ EMAIL (SMTP) ══ [email] enabled = true smtp_host = "smtp.acme.com" smtp_port = 587 smtp_tls = true smtp_user_env = "SMTP_USER" smtp_pass_env = "SMTP_PASS" from_address = "[email protected]" from_name = "ZelC SOC" default_to = ["[email protected]"] critical_to = ["[email protected]", "[email protected]"] attach_evidence = true -- ══ PAGERDUTY ══ [pagerduty] enabled = true routing_key_env = "PD_ROUTING_KEY" default_severity = "critical" escalation_policy_id = "PXXXXXX" auto_resolve_after = "4 hours" dedup_prefix = "zelc-" -- ══ OPSGENIE ══ [opsgenie] enabled = false api_key_env = "OPSGENIE_API_KEY" api_url = "https://api.opsgenie.com/v2" team = "soc-team" -- ══ GENERIC WEBHOOKS ══ [webhooks] [webhooks.soc-dashboard] url_env = "WEBHOOK_SOC_DASHBOARD" method = "POST" content_type = "application/json" headers = { "X-Source" = "ZelC" } timeout_seconds = 10 retry_count = 3 [webhooks.custom-siem] url_env = "WEBHOOK_CUSTOM_SIEM" method = "POST" content_type = "application/json"
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: Vulnerability Vines -- Maps to: vines scan, vines report, vines track -- ══════════════════════════════════════════════════════════════ [api] url = "https://vines.rocheston.com/api" api_key_env = "VINES_API_KEY" [scanning] auto_scan = true scan_schedule = "daily" -- hourly | daily | weekly | manual scan_targets = ["10.0.0.0/16"] exclude_targets = ["10.0.0.1"] max_concurrent_scans = 5 [severity_thresholds] -- Auto-create tickets for vulnerabilities above this level auto_ticket_severity = "high" -- critical | high | medium | low -- Auto-block hosts with critical unpatched vulns auto_quarantine_critical = false -- Days before escalation sla_critical = 7 sla_high = 30 sla_medium = 90 [reporting] output_dir = "./vulnerability_reports" format = "pdf" include_remediation = true
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: RCF (Rocheston Compliance Framework) -- Maps to: rcf map, rcf drift, rcf gap, rcf verify -- ══════════════════════════════════════════════════════════════ [frameworks] -- Which compliance frameworks are active for this project? -- ZelC auto-maps actions to controls from these frameworks active = ["NIST-800-53", "SOC2", "ISO27001"] -- All supported: NIST-800-53 | SOC2 | ISO27001 | HIPAA | PCI-DSS | -- GDPR | CCPA | FedRAMP | CMMC | CIS | DPDP [auto_mapping] -- Automatically tag evidence with compliance controls? enabled = true map_all_frameworks = true primary_framework = "NIST-800-53" [baseline] -- Golden standard for "rcf drift check" version = "v1.0" baseline_file = "./compliance/baseline.json" auto_generate = false drift_check_interval = "6 hours" alert_on_drift = true alert_severity = "high" [gap_analysis] -- Output settings for "rcf gap report" output_dir = "./compliance/reports" format = "html" -- html | pdf | json include_recommendations = true include_evidence_links = true group_by = "framework" -- framework | control_family | status [attestation] -- Who signs off on compliance attestations? attestor_name = "SOC Manager" attestor_email = "[email protected]" auto_sign = false require_review = true validity_period = "90 days" [evidence_requirements] -- Minimum evidence freshness for a control to be "satisfied" max_evidence_age = "30 days" require_rosecoin_anchor = true min_records_per_control = 1 [custom_controls] -- Define custom control mappings beyond the built-in database -- [custom_controls.mappings] -- "acme.vpn.enforce_mfa" = ["NIST-IA-2", "SOC2-CC6.1"] -- "acme.backup.verify" = ["NIST-CP-9", "ISO-A.12.3.1"]
-- ══════════════════════════════════════════════════════════════ -- ZelC Integration: Kubernetes -- Maps to: kube isolate, kube delete, helm rollback -- ══════════════════════════════════════════════════════════════ [cluster] kubeconfig = "~/.kube/config" context = "prod-cluster" default_namespace = "default" [safety] -- Namespaces that can never have pods deleted/isolated exclude_namespaces = ["kube-system", "monitoring", "istio-system"] -- Pods that can never be killed exclude_pods = ["coredns", "metrics-server"] -- Max pods affected per action max_pods_per_action = 10 [isolation] -- NetworkPolicy template for "kube isolate pod" deny_all_ingress = true deny_all_egress = true allow_dns = true -- allow DNS even when isolated label_prefix = "zelc-isolated" [helm] -- For "helm rollback" max_history = 10 timeout_seconds = 300