01 / Data boundary
Operational records → Data location, retention and access remain explicit
Ownership · Data location · Export
Sovereignty · who owns what
Your operating record stays yours.
Seven governed layers keep data, meaning, model choice, workflows and decision authority portable so the organization can keep operating as technology changes.
Review the sovereignty model →01 / Data boundary
Operational records → Data location, retention and access remain explicit
- Ownership
- Data location
- Export
Seven layers build from data boundary through compute, model choice, semantic definitions, workflows and decision rights to a retained operating record.
1 / 7
Seven governed layers keep data, meaning, model choice, workflows and decision authority portable so the organization can keep operating as technology changes.
02 / Compute & runtime
Approved environments → Workloads execute inside the chosen boundary
Hosted · Dedicated · Your cloud
03 / Model choice
Client-selected models → Models remain replaceable inputs, not the record
Portable · Versioned · Replaceable
04 / Semantic definitions
Metrics, entities and rules → Meaning is governed outside any single model
Ontology · Definitions · History
05 / Governed workflows
Context and operating procedure → Recommendations follow bounded, reviewable paths
Context · Procedure · Lineage
06 / Decision rights
Roles, permissions and thresholds → Consequential action stays with authorized people
Authority · Approval · Audit
07 / Operating record
Sources, decisions and outcomes → A portable record the organization retains
Evidence · Decisions · Outcomes
01 / assurance is a gradient
PRINCIPLE
Chosen per workload, not sold as a toggle.
The same operating layer runs at three levels of assurance. Sensitive records and regulated data sit at the strong end of that gradient.
HostedSigned provider termsFastest path to a working operating layer. Model-call retention, training use, and human-review limits are set by the approved provider terms for the workload.
Dedicated environmentIsolated tenancyA separate environment for your operation, with its own data boundary, keys, and network posture, suited to sensitive records and regulated workloads.
Your own cloudClient-controlledThe layer runs inside the environment you already control and audit. Data location, retention, and access follow your policy, not ours.
02 / who owns what
PRINCIPLE
Stated plainly, in writing.
Yours
- Your operating data
- Your metric definitions and their version history
- The decision ledger and outcome history
- Models or tuning artifacts contractually assigned to your operation
- Exportable in agreed open formats under the engagement terms
Never
- Your data sold, shared, or used to train another client's intelligence
- Provider retention or training use outside the approved terms
- Definitions or model versions changed beneath you without your approval
- Unapproved export fees, surprise egress penalties, or audit-as-revenue
Ours
- The platform and runtime
- The agent framework
- The delivery teams
- The product roadmap
03 / commitments
PRINCIPLE
The exit door stays unlocked.
No model lock-in
The layer is model-agnostic. Your ontology, workflows, and record live outside any model, so models stay swappable inputs. A better model next year is an upgrade, not a migration.
Your record is scoped to your use
Where a workflow earns a task-specific model or tuning artifact, ownership, reuse, retention, and export are defined in the engagement terms. Your operating playbook does not become another client's feature.
No rules changed beneath you
Definitions are versioned and model versions are pinned per workflow. Changes route through your approval, on your calendar, never silently mid-season.
Human authority is retained
Recommendations carry their sources, and consequential actions are designed to require an authorized human decision. Sovereignty includes who is allowed to act.
Evaluation is part of the boundary
Accuracy, permission behavior, writeback, refusal, and rollback are checked against the workflow before expansion. The assurance bar changes with the action and the environment.