Identity before autonomy
Every production tool call must have an authenticated identity, a least-privilege permission boundary, and an accountable owner.
Trust / Authority and recovery
Earn every permission.
AI becomes operational when people can see what it did, understand why, constrain what it may do next, and recover when it is wrong.
Control principles
Safety lives inside the workflow.
Governance is implemented in identities, permissions, interfaces, evidence, and operating procedures.
Authority expands in stages: read-only observation, recommendation, human-approved action, then bounded automation only when the evidence and risk support it.
Shadow before write
Historical replay and parallel runs establish behavior before production actions are considered.
Evidence before confidence
The system must expose sources, limits, and escalation paths; important decisions are evaluated on real task examples.
Humans at the control point
Consequential workflows need explicit paths to approve, reject, correct, pause, and take over.
Rollback is a feature
Versions, fallbacks, kill switches, and the original human process must remain available in proportion to risk.
Data stays in context
Our intended default keeps customer data in its owning environment or required region; reusable methods may move under agreement, raw data does not by default.
These are delivery requirements, not a claim of external certification or pre-approved access in a customer environment. Exact controls and evidence are agreed for each workflow before authority expands.
The operating record
Work should leave evidence.
What is recorded depends on risk and customer policy, but the design goal is a reviewable chain from task to action and recovery.
Inspect the evidence boundary- 01Task and model version
- 02Authorized context and sources
- 03Policy and permission decision
- 04Human approval, rejection, or correction
- 05Action result, error, and recovery path
Data boundaries
Reusable methods move. Raw customer data does not by default.
Deployment architecture is chosen with the customer. Data stays in its owning environment or required region unless a documented, authorized path says otherwise.