Client-hosted
Your cloud account
All layers run inside the organization's own cloud environment, under its identity provider, keys, network controls, and logging.
One control plane for long-context workloads.
Every workload family runs through the same layered platform. Identity and access, audit, evaluation, FinOps, and reliability are enforced once, at the platform layer, rather than re-implemented per project.
Architecture
Five layers, five cross-cutting controls.
Requests enter through identity, gather permission-checked context, execute through an orchestrated plan-act-verify loop, reach models only through a governed gateway, and leave evidence in an append-only store. The cross-cutting controls apply to every layer.
FGGJTNBGNCR control planeReference architecture
Layer 1Identity & policy
SSO federationSAML · OIDC
Policy engineRBAC + attributes
Scoped credentialsshort-lived · per tool
Layer 2Intake & context
Connectorsgit · docs · tickets · APIs
Parsing & OCRlayout-preserving
Indexingsymbols · sections · entities
Context assemblyrank · filter · cite
Layer 3Orchestration
Plannertask graph · budgets
Queue & schedulerbackpressure
Tool executorsandboxed · idempotent
Checkpointsresume without replay
Review gatesnamed approvers
Layer 4Model gateway
Routingper-step model choice
Budget enforcementrun · workload · workspace
Context cachingreuse unchanged prefix
Concurrency controllimits · fallback
Layer 5Evidence & storage
Artifact storepatches · briefs · records
Citation ledgerclaim → source span
Run recordsreplayable
Retentionpolicy per workspace
Cross-cutting controls
Identity & accessenforced at every call
Auditappend-only ledger · exportable
Evaluationharness gates every change
FinOpsbudgets and attribution
ReliabilitySLOs and recovery
Applies to layers 1–5 · enforced in the call path, not in per-project code.
Context is permission-checked. The context engine only retrieves what the requesting user is entitled to see in the source system.
Models are reached through one gateway. Routing, budgets, caching, and fallback are applied consistently to every model call.
Evidence is a first-class output. Citations, intermediate artifacts, and run records are stored alongside the result they support.
Workload policy
Declared once. Enforced on every call.
Each workload carries one reviewed policy: whose identity it acts under, which tools it may call, what it may spend, which actions need a named approver, how long records are kept, and which evaluations every change must pass.
- Agreed before build. Access scope, budgets, and evaluation thresholds are set in Define and confirmed at G2 Ready to build.
- Read by the platform. The policy engine, tool executor, and model gateway enforce the same declaration in the call path.
- Changed under control. Edits to scopes, tools, budgets, or evaluation gates are versioned and pass G5 Change.
workload.policy.yamlIllustrative
# generic names and values workload: example/contract-review identity: act_as: requester # on behalf of sso: oidc scopes: - docs:read # inherited - records:write # gated credentials: short-lived, per call tools: allow: [search_index, extract_fields, records.update] default: deny budget: enforced_at: model-gateway scopes: [run, workload, workspace] on_limit: pause and notify owner approvals: records.update: named approver external.send: named approver retention: run_records: per workspace policy context_manifest: hashed secrets: redacted before write evaluation: gates: [G3, G4, G5] suites: [task, regression, adversarial] on_fail: block release
IAM
Identity & access
The system acts on behalf of a person, with that person's permissions. Where a service account is unavoidable, it is narrowly scoped, owned, and time-limited.
Checked throughaccess reviewspermission-inheritance testscredential expiry checks
- Single sign-on via SAML or OIDC federation with the organization's identity provider.
- Policy at three levels — workspace, workload, and individual tool — combining roles with attributes.
- Short-lived, scoped credentials issued per tool call; no long-lived secrets in prompts or context.
- Source permissions inherited — retrieval never returns content the requesting user cannot open directly.
- Separation of duties between people who build workloads, review outputs, and approve releases.
- Owned service accounts with a named owner, documented purpose, and expiry date.
LOG
Audit
Every run can answer: who asked, what the system saw, what it did, what it produced, and who approved it.
Checked throughrun replayledger integrity checksSIEM export tests
- Append-only run ledger recording requester, context manifest, model calls, tool calls, outputs, and approvals.
- Hashed context manifests so the exact inputs to any decision can be reconstructed later.
- Tool-call records with inputs and outputs, with secrets redacted before persistence.
- Exportable to the organization's SIEM or log archive in standard formats.
- Configurable retention per workspace, aligned with the data owner's policy.
- Replay of any run from its record for investigation or dispute resolution.
EVAL
Evaluation
Quality is measured against tasks defined with the people who own the work — before build, at every change, and continuously after release.
Signalstask successcitation precisionreviewer acceptanceedit distanceescalation rate
- Task-specific evaluation sets built with domain reviewers before implementation begins.
- Offline gates on every change to prompts, models, tools, or retrieval configuration.
- Online signals from real use: reviewer acceptance, corrections, and escalations.
- Regression suites re-run whenever a model provider updates a model version.
- Adversarial cases for prompt injection through documents, repositories, and tool outputs.
- Versioned results stored alongside the exact configuration that produced them.
FIN
FinOps
Cost is planned, enforced, and reported in business terms — cost per accepted output, not cost per token.
Reported ascost per accepted outputspend vs. budgetcache hit ratiomodel mix
- Budgets per workspace, workload, and run, enforced at the model gateway before spend occurs.
- Attribution of every request to a user, team, and workload for chargeback or showback.
- Context caching and retrieval so unchanged context is not re-sent on every step.
- Model routing that assigns each step the smallest model that passes its evaluation.
- Anomaly alerts on unusual spend patterns, raised before a budget is exhausted.
- Monthly cost reviews built into the operating cadence of each workload after release.
SRE
Reliability
Long-running work must survive failures in models, tools, and networks without losing progress or repeating side effects.
Managed byper-workload SLOserror budgetsrunbooksincident review
- Checkpointed state after every step; runs resume where they stopped.
- Idempotent tool calls with bounded retries and exponential backoff.
- Circuit breakers on model providers and downstream tools to contain failures.
- Tested fallback paths across model providers, exercised before they are needed.
- Queue-based concurrency with backpressure, so load spikes degrade gracefully.
- SLOs and error budgets defined per workload, with runbooks and post-incident review.
Deployment models
Runs where your data governance requires.
The deployment model is chosen during Assess, based on data residency, security requirements, and who will operate the system day to day.
Dedicated
Single-tenant dedicated
An isolated, single-tenant environment dedicated to one organization, with its own storage, keys, and audit export. Operating responsibilities are set out in the engagement agreement.
Hybrid
Split control and data
Connectors, context assembly, tool execution, and the evidence store run in the organization's environment; orchestration and evaluation tooling run in a separate, dedicated control environment. Every data flow between the two is named in the data-handling terms.
Security & trust
What a security review receives.
Security and architecture teams assess the platform on written material, not on assurances: what they receive, how model providers are governed, and how incidents are reported.
Provided during review
Review package
- Architecture and data-flow diagrams for the chosen deployment model.
- Access-scope matrix per workload and tool.
- Audit-ledger schema and a sample export.
- Evaluation and adversarial test reports.
- Responses to the organization's security questionnaire.
Model gateway
Model providers
- Reached only through the model gateway.
- Providers and sub-processors that can receive client data are named in the written data-handling terms before any data is accessed.
- Adding or replacing a provider is a material change that passes G5 Change with regression and adversarial re-evaluation.
Reporting
Incidents & disclosure
- Incidents affecting client data are reported to the organization's named contacts within the notification period set in the written agreement.
- Each is followed by a written post-incident review.
- Vulnerability reports go to [email protected] with the subject “Security”.
Platform review
Need a platform and security review?
We walk your security and architecture teams through the control plane, data flows, and evidence model, mechanism by mechanism.