01Platform
An execution substrate you can read, audit and turn off.
Agents are stateless functions with a prompt and a schema. The state machine that decides what runs next lives in your infrastructure, in code your engineers can read. Nothing about this architecture asks you to trust a model with control flow.
- Runs in
- Your cloud account, your VPC, your KMS
- Control flow
- Explicit state machine in Postgres
- Providers
- Model agnostic behind one versioned interface
- Isolation
- One compute cell per engagement
- Audit
- Append-only, emitted to your log estate
02Execution model
One request, six stages, and a gate no machine can open.
The run below is the shape of every engagement. What changes between clients is the tool manifest, the corpora and who holds the gate.
> run.trace — every step recorded, append-only
Planning agents
Decompose a request into a typed task graph against the tools that actually exist in your estate, and refuse the ones that do not.
- Task decomposition bounded by a declared tool manifest, not open-ended autonomy
- Every plan is a serialisable graph, inspectable before a single tool call fires
- Cost and latency budgets attached at plan time and enforced at execution
- Replans on failure are capped and logged; there is no unbounded retry loop
Retrieval and context assembly
Fetch from the corpora this request is entitled to reach, and record what was read at the moment it was read.
- Entitlements resolved at the index boundary, so information barriers are structural
- Hybrid lexical and dense retrieval with reranking over your own documents
- Every retrieved span is pinned to the answer it supports, for later citation
- Corpus freshness stamped into the record; a stale read is visible, not silent
Execution agents
Call tools inside an isolation cell with a scoped credential, a time budget and no ambient network access.
- One cell per engagement: scoped credentials, egress allowlist, no shared state
- Tool calls are typed and schema-validated in both directions
- Writes default to draft. Post, send and decide rights are withheld unless granted
- Deterministic replay from the recorded call log, for incident reconstruction
Guardrail and compliance agents
Check the output against policy, jurisdiction and prohibited-inference rules before any human sees it.
- Policy checks run as separate graded agents, not as instructions inside the main prompt
- Prohibited-inference rules enforced by evaluation, not by asking the model nicely
- Prompt-injection resistance tested against your own adversarial corpus on every release
- A failed check stops the run and raises the reason; it does not silently degrade
Human approval gates
Route to the role that holds the authority today, with the evidence already assembled, and wait.
- Gates map to existing authority: the credit officer, the MLRO, the licensed adjuster
- The approver sees the recommendation, the evidence and what the system was unsure about
- Approve, amend and reject are all first-class outcomes and all are recorded
- No path exists that reaches a consequential action without a named human actor
Evaluation and audit
Score every run against your adjudicated cases and emit an append-only record your auditor can read.
- Evaluation suites seeded from your historical decisions, not public benchmarks
- Model and prompt versions recorded per output; upgrades gated on regression
- Append-only audit log covering every AI output and every human decision
- Drift monitoring against the baseline captured in week one of the engagement
03Architecture principles
Six decisions that are hard to reverse, made deliberately.
Model agnostic by construction
Providers sit behind one versioned interface. Swapping a frontier model, or running two in parallel for comparison, is a configuration change and a regression run, not a rebuild. Institutions that cannot take a hard dependency on a single vendor are the ones we built this for.
The state machine owns control flow
Agents are stateless functions with a prompt and a schema. What runs next is decided by an explicit state machine in your infrastructure, not by a model reasoning its way through a framework. This is the difference between a system you can reason about at three in the morning and one you cannot.
Isolation cells, one per engagement
Compute, credentials, indexes and logs are separated per engagement. There is no shared inference pool across clients and no shared vector index. Cross-tenant contamination is prevented by topology rather than by policy.
Untrusted input, everywhere
Documents, emails, and third-party API responses are treated as adversarial input. Extraction is separated from reasoning, extraction output is data and never instruction, and injection resistance is a test in the release gate rather than a hope.
Runs in your estate
Deployment targets your cloud account, your VPC and your key management. Data residency follows your existing obligations because the compute never leaves them. Where an on-premise path is required, the control plane supports it.
Evidence is a build artefact
The model risk pack is generated continuously from live run data, starting in week two. By the time internal audit asks, the evidence already exists and covers the period they care about, rather than being reconstructed afterwards.
04What we will not build
The boundary matters as much as the capability.
A platform is defined by what it refuses. These are not roadmap items we have not reached yet. They are excluded by design, and the exclusions are part of what makes the rest deployable.
- 01
No auto-decision path
There is no state transition to a consequential outcome without a named human actor. This is asserted in tests, not described in a policy document.
- 02
No third-party data enrichment in decisioning
Cross-checking an applicant against purchased data sets is how a software vendor becomes a consumer reporting agency. We stay out of that regime entirely.
- 03
No inference on protected or proxy attributes
Age, date of birth, graduation year, postcode as a proxy, name weighting and employment-gap penalties are excluded at the prompt and enforced in the evaluation gate.
- 04
No affect, tone or facial analysis
Not in claims, not in servicing, not in hiring. The research base is weak and the regulatory exposure is severe.
- 05
No shared inference pool across clients
One isolation cell per engagement. Cross-tenant separation is a property of the topology, not a promise in a contract.
Next
Bring us your architecture review and your model risk policy.