The four components
AOP Runtime. Deterministic rule enforcement on the hot path. Resolves your AOPs across the five precedence layers and returns permit, hold, or deny in well under ten milliseconds at p95. No model on the action path.
Validation Pipeline. The deterministic fast path for everything, plus asynchronous model checks reserved for high-risk responses: grounding, tone, topic.
Compliance Library. The universal baseline plus versioned packs by industry and jurisdiction, layered under your tenant rules at fixed precedence: compliance, jurisdiction, agent type, base, campaign.
Audit Engine. Append-only, hash-chained decision records. Tamper-evident. Personal data is kept out of the chain by architecture, not by policy.
Fail postures, by path
The action path and connector execution fail closed: no verdict, no action. The input gate and the response model layer fail open and record, so a screening layer can never silently kill legitimate work. Caps on the model layers skip the model work over budget and fail open, recorded.
Inversion of control, concretely
An ActionEnvelope arrives: agent, action, parameters, context. A permit returns a decision identifier. A connector executes only against that identifier, server side, with encrypted write-only credentials stored on our side. The agent never sees a key and has no path to act alone.
The stack
Python, FastAPI, Pydantic, Postgres. No polyglot. Deterministic where consequence lives, models only where judgment helps and failure is safe.