A model drafts; broker code checks; you commit.
An administrator asks, and the ops copilot drafts, on the separate admin entry point only. Its rule is that the model only proposes, deterministic broker code verifies, and a commit is recorded in the audit and transparency logs. There is no code path from the model's output to enforcement that skips the broker's checks and an administrator.
What the model may draft
- Access rules. Drafted from your request, then parsed, validated and simulated by the broker before you see them.
- Agent policies, with AI agents switched on too. Each agent gets exactly one human owner, a permission ceiling and a token lifetime; the broker, not the model, mints its secret.
- Runbook scripts, with runbooks switched on too: the small script that picks a response to a risk signal, compiled in a sandbox and dry-run over sample cases.
- Posture Advisor fixes, with the advisor switched on too: the model ranks and drafts fixes for findings from deterministic checks, and an accepted fix goes through the same commit.
- Explanations of a policy decision: the model only rewords the engine's decision, and the broker rejects an explanation whose verdict or rule ids differ from the real trace, falling back to a template built from the trace.
Runbooks are explained on the risk and response page.
When it drafts an access rule, the copilot can ask for clarification instead of guessing, once an opt-in confidence threshold is set and the model reports token log-probabilities. Without that threshold, the draft comes back with its measured confidence as a warning.
What a commit does
An administrator commits a draft. The broker re-checks the exact draft the administrator reviewed, bound by its hash, and the draft is stored switched off: an access rule or an agent disabled, a runbook script advisory. Turning it on is a separate human action. A drafted access rule that would switch off or weaken a live rule is refused unless the administrator explicitly confirms the overwrite. A drafted runbook script replaces the live rule for its signal.
The commit is recorded in the admin activity log and the transparency log, and the records keep ids and hashes, never the model's text. Each carries a receipt: the model id, the SHA-256 of the model weights, the prompt and grammar hashes, the fixed greedy decoding, the draft hash and the digest of the broker's own check.
Where the model runs
On your own network. The broker sends prompts to a model server you run, at a loopback or private-network address, written as an IP address or localhost; a public address or any other hostname stops the broker at start-up.
For your engineers
Technical detail: the commit
What this does not show: model quality, a live run, or runbook and agent drafts; this figure is illustrative.
Text version
Model proposes
- an access rule, action deny
- another, action grant
Broker code verifies
- deny, in the closed list: passes
- grant, not in it: refused, and it cannot be committed
Log records, when an administrator commits
- receipt: weights_sha256, prompt_hash, grammar_hash
- the weights hash is supplied by the operator, and recorded as unset if left blank
There is no code path from the model's output to enforcement that skips the broker's checks and an administrator.
The model server is a llama.cpp or OpenAI-compatible server.
Questions
Can the model change a policy by itself?
No. The broker checks each draft, an administrator commits it, and it is stored switched off until someone turns it on.
Where do prompts go?
To the model address you configure, which must be a loopback or private-network address, written as an IP address or localhost. A private address can be another machine on your network.
Is everything the copilot does logged?
No. A commit is recorded in the admin activity log and the transparency log. An explanation, or a draft nobody commits, is noted only as a request in the admin activity log: no receipt is kept and nothing reaches the transparency log.
Does the copilot work in an air-gapped install?
That is not proven. Our air-gap test covers the identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.