Choose the workflow. Keep control of the data.

An application states the work it needs done and the threshold a model must clear to be sufficient for it. This happens before runtime, not on every prompt.

BoundSense decides which candidate models and which environments are permitted for this task and information class. Everything after this point works inside that set.

Forge measures each permitted candidate against the task threshold. Forge may narrow the permitted set to the candidates that pass. It can never widen it.

The selected candidate, the rejected alternatives, the measured results and the fallback path are recorded so the choice can be reviewed afterwards.

Permitted to leaveSelected model · rejected alternatives · measured results · fallback path

Runtime consumes the record, not a fresh benchmark. A live request does not re-evaluate every candidate model.

Someone asks a question, submits a document, or continues a customer conversation.

Cortex or Axon assembles the request from approved sources and context. It may request capability; it cannot grant itself any.

Sensitive values are found before anything moves, and each one is assigned a class the policy can reason about.

The active profile decides per class what may cross, in what form, into which environments, and whether a named person must approve first.

Values that may cross in shape but not in substance are tokenised. Values that must stay put are contained. Prohibited crossings are refused outright.

Crossing permitted, after transformation

The model that runs is the one the selection record names, and it is still inside the set BoundSense permitted. A failed threshold cannot be overridden downstream.

Local, private, or approved external: whichever the policy decision allowed for this information class.

Nothing goes straight back to the application. The return path is governed exactly like the outbound one.

An unknown or malformed token, or a sensitive value the model produced on its own, stops the crossing rather than reaching the user.

Response inspected · release permitted

Tokenised values are restored locally where policy allows, and the application presents the answer with its evidence or carries it on into the workflow.

BoundSense contributes the crossing decision, Forge the selection basis, and the application its workflow and source evidence, combined into a single record a reviewer can read.

Permitted to leavePolicy decision · classification · transformation · selection basis · response provenance

One immutable package identifies the task, the candidate, the runner and the metrics, so every node evaluates the same thing and the run can be repeated.

Each node authorises independently: which package, which candidate, which local dataset reference, and what may leave. One node’s permission never extends to another.

Each environment runs the candidate against its own dataset, under its own access controls, and records complete evidence locally.

The examples themselves are not centralised in order to score them. They remain inside the approved environment that holds them.

Raw examples contained locally

Each node emits the metrics, findings and evidence its local policy explicitly allows, and nothing else.

Permitted to leaveMetrics · safety findings · failure counts · local evidence identities

Aggregation records which nodes participated, which were unavailable and which were excluded, so a partial run is never read as a complete one.

Global, per-node, subgroup and jurisdiction criteria are checked in their own right.

Global threshold: passed

One required environment falls below its threshold. The global average still passes. That is exactly the case the design exists for.

Required node threshold: failed

A passing global metric does not release promotion on its own. The candidate is held until the required node passes or the task specification changes.

Promotion: held

One record links the aggregate result to each node’s local evidence identity. Failed and refused evaluations are not rewritten to make a candidate look successful.

An analyst or a workflow asks something that may need evidence held in more than one controlled environment.

The question itself is classified. BoundSense decides which nodes and sources are eligible, and what the query must look like before it travels.

An environment that was not authorised for this question never sees it.

Each node searches its own sources under its own access controls. Nothing is pooled into a central index to answer the question.

The corpora themselves stay inside their approved environments, with their own retention and deletion rules.

Source corpora contained locally

Excerpts, structured facts, a local answer, or a provenance reference: whichever the node’s policy permits, and nothing beyond it.

Permitted to leaveExcerpts · structured facts · local answers · provenance references

Duplicate findings, contradictions between nodes, unavailable nodes and source provenance are resolved before anything is composed.

Each factual claim points to evidence that actually supports it, with its node and source provenance attached.

Answer released with citations

A required node that did not answer, or evidence too thin to carry the claim, is stated plainly rather than filled in.

Required node unavailable · answer qualified

The query decision, node participation, citations and stated limitations are recorded together with the answer.