Pillar 03 · Secure · Helix

DNA firewall — if it isn’t certified, it doesn’t pass.

Helix asks one question: is this still the certified app? Learn, promote, shadow, then enforce from live traffic DNA. Allow while securing.

  1. 01 Learn record DNA
  2. 02 Promote sign identity
  3. 03 Shadow alert only
  4. 04 Enforce block holes
Helix DNA firewall: live traffic feeds certified app DNA (route, schema, status). Learn records, shadow alerts, enforce blocks DNA holes with 403. Allow while securing; augment NGFW; optional CWL bridge.

How Helix runs

Allow traffic while you secure it.

Modes separate pass from trust. You never flip from “open internet” to “locked” in one scary click.

  1. 01 · Learn Pass + record

    Watch production

    Observe real requests and responses. Build app-dna from what the app actually does.

    • Traffic still flows
    • Baseline forms
  2. 02 · Promote Review + sign

    Certify the DNA

    Diff the certificate. Promote only what you intend. Reload without downtime.

    • Human-reviewed diff
    • Hot reload
  3. 03 · Shadow Pass + alert

    Score without blocking

    Live traffic vs certified DNA. Holes alert only — users keep working.

    • Drift visible
    • Zero user impact
  4. 04 · Enforce Block · 403

    Fail closed

    Unauthorized surface stops. We don’t allow app shape we didn’t certify.

    • Unknown routes die
    • Certified shape holds

What DNA fingerprints

Identity, not payload theater.

Routes

Which URLs and methods the app is allowed to expose — new paths are holes until promoted.

Schema · query

Shape of bodies and query strings that belong to certified routes — drift shows up as identity failure.

Status · behavior

Expected response patterns for the certified surface — not a replacement for a WAF on payloads.

DNA holes are identity failures (HX-ROUTE-UNKNOWN, schema drift, …). Keep a WAF for payload attacks on routes that are in DNA.

Where Helix sits

In front of your app. No firewall redesign.

Internet clients hit Helix on the public port. Helix talks to your app on localhost. Your existing NGFW / NAT stays put — Helix is the identity layer in front of the process.

Operators call this Mode A: same box, public listener moves to Helix, app binds loopback. You keep allowing traffic while Helix learns, shadows, then enforces.

Scope

Helix certifies live app identity.

It learns what your app actually does from traffic, then blocks new surface that was never certified. That works on its own. You do not need CWL or Convert to turn Helix on.

  • Not a WAF — keep yours for payload attacks on known routes
  • Not “CWL is the firewall” — language and traffic identity stay separate
  • CWL is only relevant later if you want Convert’s description checked against live traffic
Start a Pilot Convert · Universal Translator DNA overview →