Trust · architecture and assurance
Lagstyr is being built so consequential agent work remains explainable, bounded, verifiable, and owned by the company—including when the model is wrong, evidence is absent, an external processor is refused, or the vendor is unreachable.
Load-bearing commitments
These principles shape the product design and are exercised in the implemented foundation. Their current evidence standing is recorded below.
An AI agent can never change a real system directly. Every change passes through a gateway that checks it against policy—the action’s exact shape, its limits, and its approvers are fixed by the company, and the agent cannot choose its own risk tier or its own approvers. Every model call travels the same governed loop; a repository check refuses any second path.
The check is not an application-layer courtesy. The route, approver, role, grant, and policy versions are locked until a decision commits, so a role closed mid-approval voids it. Overlapping approval routes cannot be stored; backdating is refused by the database itself; thresholds cannot be edited in place, only retired and replaced under governance; a copied database credential cannot write.
Company records preserve the entity, source, actor, causation, correlation, history, and confidence needed to reconstruct why work happened. History is append-only and chained daily, so it cannot be rewritten without detection.
An accepted proposal is not proof of success. Idempotency (an action safe to retry), receipts, read-back of the owning system, and reconciliation establish what actually happened; a partial or unknown outcome stays partial or unknown until it is resolved. An effect crosses one two-phase fence before it reaches a provider: the claim step releases nothing a provider could act on, only the start step hands over the payload and the kernel-minted idempotency key, and an answer of unknown keeps the attempt without creating a receipt—uncertainty is not evidence that an external effect occurred.
Connecting a consent-only provider uses an authorisation-code flow with PKCE always on, and custody is split so that no one component can act alone: the console holds only the short-lived flow state, the kernel holds the authority record and never a refresh token or client secret, a separate broker with no inbound listener holds the sealing key and performs the exchange, and the connector receives only a short-lived access token. The installation registers its own client with the provider. No vendor key is on that path, and disconnecting is an immediate, re-authenticated act rather than a proposal.
What your build ships is rendered from the binary’s own compiled catalogue, so an operator can see the capability they have without the software contacting anyone. A vendor-hosted catalogue of available connections was considered and refused outright as a call home. Optional capability is inert until a governed decision with a second approver activates it, showing a capability never enables it, and what the console cannot start it does not offer to start.
Prompts, models, skills, schemas, policy, rubrics, and governance change through proposal and approval, applied atomically on approval. No agent silently expands its own powers, and no agent can supply the evidence that clears its own gate.
Scanned pages are read by text-recognition (OCR) software that ships inside your installation—a fixed, known version, qualified on our own test set for seven Latin-script languages and a narrow synthetic-handwriting envelope. Nothing is sent to an outside service and nothing is downloaded at run time. Every page records how it was read: embedded text, OCR, or explicitly unreadable.
The authoritative record, document intake, full-text search, and operator console work without a hosted model or embedding key. The reference configuration enables no hosted processor or agent credential; an unconfigured semantic request refuses explicitly rather than silently becoming a different answer.
Managed local processors need a current root-issued runtime proof before each export. Hosted processors need the exact approved endpoint, purpose, workload, and data class. Processor selection cannot grant an agent authority or override classification, retention, erasure, or local policy.
Any single decision can be reconstructed from one consistent snapshot—authorisation, mandate, policy, evidence, human approval, agent run, effect receipts, causal events, resulting obligations—and exported as a checksummed pack in OSCAL, ECS, and CEF formats with a non-normative ISO/IEC 42001 mapping. It is an export of the record, not a certification; gaps in history stay visible as gaps.
Missing effects or measurements remain not configured or need attention. Released minutes are not converted into money, and financial value is not inferred from activity or prose.
One isolated deployment serves one customer on bring-your-own-compute: customer-controlled hardware, a rented host, or private or public cloud, directly or through an approved operator; never a shared data plane. Sign-in, provisioning, and workload identity can come from your identity provider, and an AuthZEN connection can consult your policy engine—none of which can grant what the local rules refuse. No online licence check, vendor heartbeat, mandatory telemetry, vendor-held runtime credential, or inbound management endpoint is intended to block company operation.
System boundaries
Lagstyr does not claim authority it should not own. The ledger remains authoritative for accounting; payroll for pay; CRM for pipeline; repositories for code. Lagstyr holds the management record that connects their work.
Mandates, evidence, decisions, approvals, obligations, agent actions, effects, conflicts, measures, and outcomes.
Accounts, payroll, customer pipeline, purchase orders, payments, communications, code, deployments, and tickets remain with their owning systems.
Search indexes, summaries, and model outputs can always be rebuilt. They never silently outrank the authoritative records they were derived from.
Current assurance position
Behind the build sit more than 5,800 automated tests in the source tree, deliberate fault-injection (mutation) testing with a written disposition ledger, isolated end-to-end launch rehearsals, security-oriented design gates that are proven by making them fail, and a release gate with named human approvers that has already refused a release. That is real discipline—and it is not the same as customer or independent assurance, so we label the difference.
Deterministic contracts, paths that refuse rather than guess when checks fail, least-authority boundaries between components, security checks in the build pipeline, and dated evidence documents for drills and rehearsals.
A reproducible, licensed synthetic test set exercises bounded indexing, in-installation OCR in seven languages, extraction with exact source passages, human-only promotion to record, and explicit refusal states. A clean-room journey exercises one bounded autonomous action with post-action review and one approved send, and a decision evidence pack exports with checksums. It is our own test data, run by us; the dated entries are on the development page.
Pinned offline local embedding and optional local-agent closures, loopback-only transport, per-send root admission, workload traffic fences, explicit hosted-provider policy, and no-model boot are implemented and technically exercised. No local model is advertised as qualified, and the complete installed default has not yet produced the required observed traffic and capacity evidence.
A provisioned installation, restore and failure drills in that environment, observed capacity, support operation, upgrade evidence, and live end-to-end integration proof.
No independent penetration test, SOC 2 report, ISO/IEC 27001 certification, ISO/IEC 42001 certification, formal high-availability claim, or production customer reference.
Security claims will be updated when evidence changes. Until then, this page is intentionally narrower than the product ambition.
Our security page explains where to send a report, what is in scope today, what happens next, and our good-faith research commitment.