For a security reviewer: what to ask to see
The trust claims one by one, and what to ask to see for each before a trial.
The trust properties
| Property | What it means | Ask to see |
|---|---|---|
| Evidence-backed | Every output is tied to the sources and reasoning that produced it. | One output traced back to its sources and its reasoning. |
| Coherence-gated | Consequential actions pass a coherence check before they execute. | An action the check stopped, and why. |
| Schema-validated | Data is validated against explicit schema contracts before it lands, so drift is caught before it spreads. | A record that failed validation, and what happened to it. |
| Fully audited | A complete, queryable, tamper-evident record of what happened, when, by whom and why. | One decision read back from the audit record: who, when, what and why. |
| Provenance throughout | The platform knows how knowledge entered, who created it and what it supports. | The provenance of one fact. |
| Human approval where it matters | Bounded autonomy where it is safe; on consequential moves, a person accepts at the point of effect: reversible moves with a short undo window, irreversible ones with a deliberate confirmation. | The lanes with autonomy turned up, and the moves that still wait for a person. |
| Tenant-isolated by design | Each tenant's knowledge is structurally separated, by architecture, not by policy. A tenant's credentials cannot reach another tenant's estate. | How isolation is enforced, and what a credential from one tenant can address. |
| Grounding guards | Two rules enforced as engineering practice, not prompt manners. Look up before you make up: ground in validated knowledge before generating. Verify the effect: confirm an action landed before reporting success. | A task whose report of success was checked against the effect. |
Claims and what to ask to see
| Claim | Ask to see |
|---|---|
| Memory persists across sessions, agents and teams. | A fact recorded in one session, retrieved by a different agent in another. |
| New entities need a person's confirmation. | The proposal queue, and the confirmation on one entity. |
| Context is schema-validated before it reaches a model. | A context assembly that failed its shape check, and what happened next. |
| Tasks close on evidence, not on the agent's report. | A closed task and the evidence that closed it. |
| Failures become tracked records. | One failure record, its measured cause, and the fix carried to closure. |
| Autonomy is set per lane, with shadow first and a kill switch. | Two lanes at different autonomy, and a new behavior running in shadow with its decision date. |
| You can brake the fleet or one lane, and held is told apart from silent. | A held lane and a quiet lane, side by side. |
| A Desk card that lacks context is refused. | A refused card, and the reason it was refused. |
| Irreversible actions wait for a deliberate confirmation. | An outbound message or payment waiting for confirmation, beside a reversible action with its undo window. |
| Decisions are on a queryable, tamper-evident record. | One decision read back: who, when, what they chose, the sources and the reasoning. |
| Retrieval keeps relationships and spans domains in one pass. | One query answered with the related facts it pulled from more than one domain, links intact. |
| Content cannot publish while it draws on embargoed or pre-filing material. | The pre-publish gate holding a piece, and the material it was holding for. |
| Tenants are isolated by architecture. | How isolation is enforced, and what one tenant's credential can address. |
| Consequential actions pass a coherence check before they execute. | One action the coherence check held, and why it held it. |
| External-model counsel is redaction-checked and IP-gated. | One counsel request as sent, after redaction, beside the original. |
These are requests to make in any evaluation. The first steps of early access are laid out at https://octo.ad/start/; timing and commercial terms are not published; ask the team.
Terms such as lane, shadow and the Desk are defined in the glossary.
Steps
- Read the trust properties below, and what to ask to see for each.
- Ask for the review sheet for the one scoped connection. It is written down before anything connects.
- Ask what stops a tenant credential from reaching another tenant's data, structurally.
- Ask to replay one consequential decision. The options, the reasoning, and who approved it.
- List what you need that is not published, and ask the team for it under early access.
What you have at the end
Each claim checked against something you were shown, not against a sentence on a page.