Deterministic first
Safety rules run before any model — watchlist, stolen document, visa status. Built-in rules always win; a misconfigured custom rule can never override them.
Guard · always first
Sovereign · in-Kingdom AI · bilingual
last 10
Approvals you can stand behind.
Deterministic safety rules first, a supervised AI interview for the hard cases, and every decision hash-chained — an audit trail built to be defended.
Deterministic-first
Supervised AI interview
Tamper-evident audit
Sovereign, bilingual, and built to be defended.
Case ledger
Most recent first
Layla HaddadApproved97%
Omar FaroukEscalated68%
Chen WeiApproved94%
Ivan PetrovDenied88%
Aisha NoorApproved99%
Every passenger, screened against the registers that matter — before any model is consulted.
The pipeline
Built for the desk, not the demo.
Two independent minds weigh every passenger — a deterministic guard that can't be argued with, and a supervised model that explains itself.
Supervised interview
Ambiguous cases get a calm interview — one question at a time, in the passenger's language. An officer makes the final call; never the model alone.
Human-in-the-loop
Tamper-evident by design
Every state change is hash-chained from a genesis anchor. Truncation is detectable in seconds, and every export is HMAC-signed for review.
Audit · genesis-anchored
Global reach
Every arrival, from anywhere.
Wherever a passenger's journey begins, Muwafik screens them the moment they reach the Kingdom's border — the same deterministic guard, the same supervised interview, the same tamper-evident record, every time.
Everything the desk needs
One system, from intake to audit.
A rule engine you control
Author hard and advisory rules in a safe JSON DSL — allow-listed fields and operators, no code, no eval. Built-in safety rules always take precedence over anything custom.
Bilingual, RTL-native
Passenger and operator, Arabic and English — including the AI interview.
Access you can prove
Role-based permissions, TOTP MFA, and a named operator on every action.
Reference registers, built in
Visa, passport, national-ID and watchlist lookups feed the decision — cross-checked against the numbers the operator and passenger supply at intake.
Federate your own sources
Connect existing SQL databases or REST APIs. SELECT-only, row-capped, SSRF-guarded, credentials encrypted — your local registers answer first.
Backups & retention
Live-safe online backups, and a two-tier retention job that purges personal data on schedule while keeping the defensible record intact.
Why Muwafik
2
Two minds on every decision.
A deterministic guard and a supervised model both weigh in before a passenger is cleared. Neither can be talked out of the rules.
Decision pipeline
1
IntakePassenger + travel document
2
Deterministic guardWatchlist · visa · stolen-doc
3
Supervised interviewOnly if the case is ambiguous
Verdict + officer sign-offWritten to the audit chain
Every step hash-chained, genesis to verdict
See it in motion
A 90-second walkthrough, both sides of the desk.
Follow one real case from the traveller's check-in through the deterministic guard, the supervised interview, the officer's decision, and the sealed audit record.
The walkthrough is choreographed for a larger screen. Open it in a new tab to watch.
The record
Auditable to the last hash.
Muwafik is built so that months later, in a review or a court, you can show exactly what was decided, by whom, on what evidence — and prove the record was never touched.
Chain of custody
Every session carries a genesis-anchored hash chain. The head is mirrored on the session, so truncation is detectable in seconds.
Encrypted at rest
Passenger personal data is Fernet-encrypted field by field, blind-indexed for search, with master-key rotation built in.
Access you can prove
Role-based access, TOTP MFA, and HMAC-signed exports make every action attributable to a named officer.
By design
Guarantees, not aspirations.
100%
Decisions hash-chained
Genesis to verdict
2×
Independent safety layers
Guard + supervised model
EN·AR
Bilingual, RTL-native
Passenger + operator
Deployment
Deploy it your way.
Sovereign by default — Muwafik runs inside your infrastructure. Nothing leaves your tenancy unless you say so.
Evaluation
Pilot
Single desk · local model
- One intake desk
- Local model (Ollama) or your endpoint
- Rules, reference registers, full audit
- Standard support
Recommended
Production
Sovereign
Your tenancy or on-prem
- In-Kingdom managed model or your own
- High-availability, multi-worker
- SSO-ready, MFA, IAM roles
- External-source federation
- Signed audit export + backups
- Priority support
Pricing scales with desks and deployment — no per-decision fees.
Questions authorities ask
The answers that matter for a border deployment.
Where does passenger data go?
Nowhere you don't control. Muwafik runs inside your own infrastructure; with an in-Kingdom or on-prem model, passenger data never leaves your tenancy. A residency guard refuses to boot against an out-of-Kingdom model unless you explicitly acknowledge the cross-border transfer.
Is the AI making decisions on its own?
No. Deterministic safety rules run first and always win. Only ambiguous cases reach the model, which conducts a supervised, one-question-at-a-time interview — and an officer signs off the verdict. The model never clears or refuses a passenger alone.
Can we run it fully on-prem or air-gapped?
Yes. A local model (Ollama) needs no internet, fonts and assets are self-hosted, and the security policy allow-lists no third-party origins. The whole system runs from your own hardware.
How is the audit defensible months later?
Every state change is hash-chained from a genesis anchor, and the chain head is mirrored so any truncation is detectable in seconds. Exports are HMAC-signed, so a record can be verified independently — in a review or in court.
Does it work in Arabic?
Fully. Both the passenger interview and the operator console are bilingual English/Arabic with native right-to-left layout — not a bolted-on translation.
How is personal data protected at rest?
Passenger PII is Fernet-encrypted field by field and blind-indexed for search, with master-key rotation. Access is role-gated with MFA and named operators, and a retention job purges personal data on the schedule you set.
Ready to modernise the desk?
See Muwafik clear a passenger end to end — deterministic guard, supervised interview, signed audit. We'll walk your team through a live decision.