Principles
- All model requests go through one orchestration layer with provider configuration, timeouts, retries, usage limits and fallback.
- The model is not an authority: tools, permissions and policies are enforced by the server.
- Untrusted inputs stay untrusted: user text, retrieved documents, web pages, transcripts and tool outputs cannot override system policy.
- Every AI run is recorded with model, prompt version, tool-schema version, latency, usage and outcome.
- Humans stay in the loop for low-confidence or high-impact outputs.
Tool use
Agents can only call tools on an allowlist. Each call is validated against a schema, authorized on the server independent of model intent and recorded with the decision. Higher-risk tools can require approval. There is no direct SQL, shell, filesystem or arbitrary network access from model-generated actions.
Structured outputs
When a model’s output is consumed by software, it must match a defined schema. Invalid output fails closed or gets one bounded repair attempt; it never silently flows into a workflow.
Evaluation and release gates
Agents and prompts are versioned and tested before publishing: scripted scenarios, expected outcomes, tool-safety checks, refusal and escalation behavior, prompt-injection attempts and language coverage. Published versions are immutable, so a regression can be traced to a version and rolled back.
Provenance and labelling
AI-generated summaries, extracted fields and scores are labelled and carry model and version. They are kept separate from verified facts, and people can accept, edit or reject them.
No training on your data. Customer data is not used to train shared models without a separate, explicit, opt-in agreement.
Cost and usage control
Per-tenant, per-agent and per-workflow limits and emergency caps prevent runaway usage. Cost is attributed with a clear distinction between estimated, provider-reported and reconciled values.