Security Architecture

The control plane is designed so that institutional control does not depend on the good behaviour of any model, vendor, or user. Every request is mediated, recorded, and constrained before intelligence is applied.

• Deny by default: no model, tool, or dataset is reachable until explicitly permitted.
• Control is separated from capability: models can change without changing policy.
• Every decision is attributable to an identity, a policy, and a moment in time.
• The institution retains the ability to operate without external dependencies.

Access is derived from institutional identity rather than application-level accounts. Human users, service accounts, and automated agents are distinct identity classes with separate permission surfaces.

• Integration with enterprise directories and existing authentication controls.
• Role-based access control mapped to institutional structure, not product roles.
• Separation of duties between administrators, reviewers, and operators.
• Session, device, and network conditions available as policy inputs.

Data classification defines where information may travel and which models may process it. Boundaries are enforced in the control plane rather than trusted to the calling application.

• Classification-aware routing between local, private, and external models.
• Encryption in transit and at rest under institution-held key material.
• Residency constraints expressed as policy and enforced at request time.
• Controlled egress with explicit allow-lists and retention rules.

Models, tools, and agents are treated as governed capabilities. Nothing enters production use without registration, permissioning, and evaluation criteria.

• Approved model registry with versioning and provenance.
• Per-workflow permissions for models, tools, retrieval scopes, and agents.
• Policy engine decisions attached to each request and reviewable after the fact.
• Human review gates for defined sensitivity or impact thresholds.

The audit record is designed as institutional evidence: sufficient to reconstruct why a specific output was produced, by whom, under which policy, and on which data.

• Request lineage from prompt through retrieval, routing, and output.
• Administrative and configuration changes recorded independently of operators.
• Policy decisions retained with the inputs that produced them.
• Export paths for internal audit and oversight bodies.

Deployment mode is a control, not an implementation detail. The same control plane operates across environments so that security posture can tighten without re-architecting workflows.

• Private cloud, on-premise, sovereign infrastructure, and air-gapped operation.
• Restricted-network and offline model serving where connectivity is prohibited.
• Environment separation between evaluation, pilot, and production.
• Defined update and key-rotation procedures for controlled environments.

The architecture addresses institutional threat classes that generic AI deployments leave open, and states plainly where residual risk remains with the operating institution.

• Unintended disclosure of sensitive data to external model providers.
• Unattributed or unreviewable AI-assisted decisions.
• Privilege escalation through tool and agent permissions.
• Vendor dependency and loss of operational continuity.