Synapse is a private model boundary for organizations that use outside AI models, so that each provider receives only what a task needs and each send through it is recorded.
Retains original context and the record of prior exposure.
Input is registered source material with an immutable identity, ancestry and holder binding. Closure walks the complete dependency ancestry and carries forward the most restrictive inherited labels. A derived fragment remains traceable to the exact material from which it was made.
The local source store retains the original content. Disclosure history is keyed to the relevant observer, so later requests can be considered against what that observer has already received or may have received.
Payload objects are stored encrypted; operational metadata receipts omit their plaintext. The source identity, inherited constraints and observer history remain available to subsequent admission and reconciliation. Registration and selection prepare this state; outbound permission is decided at dispatch.
Transforms local material before a view is proposed.
Local preparation transforms source material into the candidate payload and expected response shape. Capturing the request freezes a strict JSON wire representation, including the payload and schema, so mutable aliases cannot change the data after review.
This stable representation becomes part of the request’s reviewed binding. The transformation retains the source ancestry and inherited restrictions needed by the later admission check.
Planning can test whether candidate work is eligible for a supported route. Those results remain advisory and can become stale. The actual dispatch revalidates current bindings and reserves disclosure accounting before transport.
Composes a bounded request and binds its destination.
Composition joins the required local inputs and binds the captured payload to its source, canonical observer, provider/model and proposed operation. The reviewed dispatch is tied to the exact approval, policy epoch, expiry and effect identity.
Immediately before transport, the dispatch path revalidates those bindings and the applicable key/authority. A change to the request, destination or policy requires a decision under the current contract.
The route is selected before a live reservation is made. Atomic observer accounting reserves the admitted units and applicable budget under the operation identity, then permits the transport path. Shared concurrent channels consult the same cumulative record.
Checks an independently routed request before transport.
Input is a stable captured request bound to its source closure, canonical observer, provider/model, policy epoch, expiry and effect identity. Each channel revalidates the complete reviewed contract. The channels are parallel opportunities to apply that same contract, not alternative partial security checks.
The observer ledger reserves the admitted units and applicable budget in an atomic SQLite transaction before outbound transport. Concurrent requests consult the same observer history, including prior and uncertain exposure. Canonical provider-observer accounting is part of this decision.
The output is either a reserved dispatch under the exact identity or a retained held state. Advisory plans and cached eligibility do not replace this live reservation.
If transport is interrupted, the operation and its possible exposure remain retained. Unknown usage is not zero. Existing receipt reconciliation or explicit abandonment operates on that identity; no automatic refund or new-identity retry follows from a missing reply.
Checks an independently routed request before transport.
Input is a stable captured request bound to its source closure, canonical observer, provider/model, policy epoch, expiry and effect identity. Each channel revalidates the complete reviewed contract. The channels are parallel opportunities to apply that same contract, not alternative partial security checks.
The observer ledger reserves the admitted units and applicable budget in an atomic SQLite transaction before outbound transport. Concurrent requests consult the same observer history, including prior and uncertain exposure. Canonical provider-observer accounting is part of this decision.
The output is either a reserved dispatch under the exact identity or a retained held state. Advisory plans and cached eligibility do not replace this live reservation.
If transport is interrupted, the operation and its possible exposure remain retained. Unknown usage is not zero. Existing receipt reconciliation or explicit abandonment operates on that identity; no automatic refund or new-identity retry follows from a missing reply.
Checks an independently routed request before transport.
Input is a stable captured request bound to its source closure, canonical observer, provider/model, policy epoch, expiry and effect identity. Each channel revalidates the complete reviewed contract. The channels are parallel opportunities to apply that same contract, not alternative partial security checks.
The observer ledger reserves the admitted units and applicable budget in an atomic SQLite transaction before outbound transport. Concurrent requests consult the same observer history, including prior and uncertain exposure. Canonical provider-observer accounting is part of this decision.
The output is either a reserved dispatch under the exact identity or a retained held state. Advisory plans and cached eligibility do not replace this live reservation.
If transport is interrupted, the operation and its possible exposure remain retained. Unknown usage is not zero. Existing receipt reconciliation or explicit abandonment operates on that identity; no automatic refund or new-identity retry follows from a missing reply.
Processes only the admitted view for this request.
The array depicts independently organized work over an admitted input view. Source closure, observer, model and effect identity define what the request is allowed to send and which response is expected. The work does not inherit the complete local source merely by sharing a route.
For supported coding profiles, a bounded interpreter can operate on a closed AST and explicitly permitted constructs. The interpretation and independent review are profile-specific; they do not extend to arbitrary code or unrestricted tools.
The result returns with its recorded identity and usage information. Local response validation and review determine how it can be used. It remains distinct from an application effect and its separately granted authority.
Processes only the admitted view for this request.
The layers depict bounded work with explicit prerequisites. A cell plan follows required dependencies backward from the requested result, retains the necessary closure and prunes work outside that closure.
Eligibility and capacity states help determine a proposed schedule. Planning makes no provider call and grants no permission; each actual outbound dispatch is admitted and reserved under its current contract.
Each admitted operation retains its identity, expected response shape and accounting record. Its returned observation proceeds to local checking and reconciliation before it is incorporated into the continuing record.
Processes only the admitted view for this request.
The core/register form depicts a supported unit of work whose input and expected output are bounded. In a qualified coding profile, the code boundary can be a closed AST interpreted under an explicit set of allowed operations, followed by independent review.
The supported profile defines the grammar, resource limits and available effects. This role map deliberately leaves those values profile-specific rather than treating one fixture’s limits as universal.
The response is related to the exact request and evaluated as untrusted data. Current schema, bounds and intended use govern acceptance; a response cannot replace the authority that admitted the request.
Treats returned observations as untrusted until checked.
Input is a returned observation associated with an existing operation. The local return path checks expected structure, response bounds and the current control bindings before the observation is used. The response remains untrusted throughout that check.
The encrypted response payload and the metadata receipt serve different purposes: content is recovered for validation, while identity, state and usage support accounting and audit without placing plaintext into routine receipts.
An absent response or unknown usage remains uncertain. Unknown usage is not zero, and an interrupted outcome does not refund possible disclosure. The same operation remains available for recovery or explicit abandonment with its accounting retained.
Relates observations and consequences to the same originating identity.
Reconciliation takes an authenticated broker response already recorded as received, checks the exact source/observer/effect identity and retrieves that result. This path makes no new provider call.
The returned observation or consequence is related to the originating record, preserving source ancestry and cumulative disclosure history. Result state and exposure accounting remain separate facts.
When transport remains uncertain, the record preserves that uncertainty. Abandonment retains disclosure accounting and does not schedule an automatic retry. Recovery works on the existing identity rather than creating a fresh identity to bypass a held outcome.
Separates checked observations from proposals for application effects.
The comparison banks receive checked model observations and evaluate their intended use against current bounds and authority. One disposition is to reconcile the observation into the local record. Another is to present a proposal for an application effect.
That proposal needs the owning application’s separate authorization. Model inference supplies data; it does not grant the effect permission that would allow an edit, command or physical action.
The checked-return branch preserves the result’s existing identity. The authorized-output branch carries an independently permitted application operation, then returns its output or reported consequence through the checking path.
Performs only an independently authorized application effect.
Input is a proposal admitted by the owning application’s effect policy, with an exact scope and operation identity. The executor acts only under that separate permission; inference approval and effect approval are different decisions.
In supported edit workflows, a validated response can become an encrypted local proposal for review. Applying that proposal is a further bounded application action, not an implicit consequence of receiving model text.
The application records its output and reported consequence under the effect identity. The illustration sends that evidence back through checking and reconciliation so local history can relate the action to its request.
Records the output and consequence of that authorized effect.
The output register receives application output, receipt metadata and any reported consequence from the independently authorized effect. The record carries identity and state so later reconciliation can determine which operation produced the observation.
A receipt establishes what the reporting system recorded. Physical or external completion needs the evidence appropriate to that application; the receipt alone is not a universal physical-success guarantee.
Consequences return through the local checking path and join the same continuing record. Missing or uncertain results remain represented as such, while disclosure accounting is retained separately.
Adds a temporary checking route while requests need it.
An advisory cell plan walks required dependencies backward from the requested result, retains the dependency closure and prunes unrelated work. Eligibility, held and capacity states describe which bounded route could serve the request. Planning itself makes no provider call and grants no authority.
The additional checking bay visualizes this on-demand allocation. Shared users retain the same allocation until all in-flight work and receipts drain; a new user cannot reset or withdraw a live route.
Input is a stable captured request bound to its source closure, canonical observer, provider/model, policy epoch, expiry and effect identity. Each channel revalidates the complete reviewed contract. The channels are parallel opportunities to apply that same contract, not alternative partial security checks.
The observer ledger reserves the admitted units and applicable budget in an atomic SQLite transaction before outbound transport. Concurrent requests consult the same observer history, including prior and uncertain exposure. Canonical provider-observer accounting is part of this decision.
The output is either a reserved dispatch under the exact identity or a retained held state. Advisory plans and cached eligibility do not replace this live reservation.
Adds a temporary checking route while requests need it.
An advisory cell plan walks required dependencies backward from the requested result, retains the dependency closure and prunes unrelated work. Eligibility, held and capacity states describe which bounded route could serve the request. Planning itself makes no provider call and grants no authority.
The additional checking bay visualizes this on-demand allocation. Shared users retain the same allocation until all in-flight work and receipts drain; a new user cannot reset or withdraw a live route.
Input is a stable captured request bound to its source closure, canonical observer, provider/model, policy epoch, expiry and effect identity. Each channel revalidates the complete reviewed contract. The channels are parallel opportunities to apply that same contract, not alternative partial security checks.
The observer ledger reserves the admitted units and applicable budget in an atomic SQLite transaction before outbound transport. Concurrent requests consult the same observer history, including prior and uncertain exposure. Canonical provider-observer accounting is part of this decision.
The output is either a reserved dispatch under the exact identity or a retained held state. Advisory plans and cached eligibility do not replace this live reservation.
Local context stays active while independent requests use primary or adaptive checks. Each result returns through validation; application effects require their own authority.
A local request composes and processes context, then updates the same record without an external work route.
A bounded view passes a checking channel to scoped work. The returned observation is checked and reconciled with its originating record.
A separately authorized application effect follows result validation. Its output and consequence return through checking and reconciliation.
Each proposed view is checked against what its observer has already received and what remains unresolved.
Used in Naevum’s engineering workflowsDesign your model boundaryWhat the research says
The open question is whether anyone can see what left, and to whom.
Breaches at organizations with high shadow-AI use cost $670,000 more on average. The figure describes model use nobody sanctioned and nobody recorded. Synapse turns it into sanctioned, recorded use: a policy owner decides what may leave, and each call is checked against its source and against what its destination has already seen.2
An institution wants a model to help with a document. The institution holds much more information than that task requires.
The source owner assigns permitted information classes. Before dispatch, the capability fixes the observer and model, task policy, expiry and stopping conditions. The receiving model does not grant itself that authority.
Register the context against an immutable source snapshot and its provenance. Holder, actor, client and workspace identify the intended setting.
The destination and what it has already received matter to disclosure. Registering context does not itself authorize transmission.
Reserve task identity and cumulative call and byte allowances before transport. Concurrent work must account for the same finite budget.
A useful disclosure boundary considers the observer’s cumulative history.
Two individually limited requests may expose more together than either does alone. Synapse tracks what a particular observer has already received across effects, so admission can account for that accumulated view.
Source selection, task policy and allowed effects are distinct decisions. A supported coding projection also needs validation of returned edits and a recovery path back to the source. Each integration must specify the transformations and languages it supports.
The CFO sets what may leave; the boundary applies that rule on every send. Illustrative.
Illustrative situations, connected to the mechanisms that make them possible.
Institutions and R&D teams
A useful model needs context, while the organization holds a much larger sensitive source.
Software teams
A connection drops after a request may already have reached its provider.
Compute operators
Concurrent requests can pass a separate check before either has charged its usage.
A connection disappears after dispatch. The model may have received the context even though its result never arrived.
The job, step, source and policy binding remain attached to the effect.
Inspect the existing effect and its receipts. A fresh identifier cannot safely stand in for an unresolved attempt.
Received results, interrupted work and abandonment retain their disclosure history. A recovery decision follows the known state.
Coverage is specified for each supported integration and deployment. A protected task route does not establish universal IDE interception or complete operating-system containment.
It can change custody, compute location and the parties involved. Context admission, observer history and action controls still need to be designed and tested for that deployment.
The technical choices that give Synapse its particular behavior.
Synapse binds model work to an identified source, a chosen observer and a permitted effect. Cumulative disclosure history and durable recovery preserve the meaning of a task when work is concurrent or interrupted.
Bind the source. Register the context against an immutable source snapshot and its provenance. Holder, actor, client and workspace identify the intended setting.
Choose the observer. The destination and what it has already received matter to disclosure. Registering context does not itself authorize transmission.
Reserve the effect. Reserve task identity and cumulative call and byte allowances before transport. Concurrent work must account for the same finite budget.
An illustrative institutional question that needs both history and controlled model context.
Follow the storyWhich document would your CFO send to an outside model today, and which clause should never leave with it?
Design your model boundary