Naevum’s security and privacy architecture is the boundary layer for CISOs, so that a model task sees only what is permitted and an agent’s actions are checked against its authority.
Fix selected material and its derivation before constructing an external view.
Approved selected bytes and source ancestry.
Fix selected material and its derivation before constructing an external view.
Selected bytes, origin and holder.
Derived inputs and exact source closure.
The proposed view retains its exact source and holder basis.
Prepare an inspectable bounded projection under its supported profile.
Fixed source basis and exclusions.
Prepare an inspectable bounded projection under its supported profile.
Relevant local material and exclusions.
Exact proposed task view; larger source stays local where supported.
The supported profile determines what can remain local and what may be presented.
Compare new disclosure with prior and reserved exposure to the same observer.
Exact bounded task view and destination.
Prior and still-reserved units for the canonical observer.
Fixed combination rule and observer identity basis.
Exposure and uncertainty stay in observer history.
Compare new disclosure with prior and reserved exposure to the same observer.
Aliases share observer identity.
Prior/reserved units and prohibited combinations.
A new disclosure is evaluated together with prior and reserved exposure to the same observer.
Bind the admitted request before transport under all applicable limits.
Exact candidate with cumulative exposure result.
Matching approval, scope and expiry.
Actual supported route, stop state and cumulative limits.
Bind the admitted request before transport under all applicable limits.
Request, model, policy, expiry and stop state.
Call/byte bounds and approval; no grant inferred from available budget.
Available budget does not supply approval; all binding limits still apply.
Carry the reserved work through the specifically qualified route.
One admitted reserved binding.
Carry the reserved work through the specifically qualified route.
Declared client/tool/descendant scope.
The original effect identity.
The transport is limited to its specifically qualified route and original effect identity.
Retain the returned artifact, source lineage and uncertain effects.
Original issued identity.
Actual receipt/artifact or uncertainty.
Retain the returned artifact, source lineage and uncertain effects.
Received result and exact source/task binding.
Independent receipt or unresolved uncertainty without exposure refund.
Uncertainty does not refund possible exposure or authorize a replacement effect.
Approved selected bytes and source ancestry.
Fix selected material and its derivation before constructing an external view.
Selected bytes, origin and holder.
Derived inputs and exact source closure.
The proposed view retains its exact source and holder basis.
Fixed source basis and exclusions.
Prepare an inspectable bounded projection under its supported profile.
Relevant local material and exclusions.
Exact proposed task view; larger source stays local where supported.
The supported profile determines what can remain local and what may be presented.
Exact bounded task view and destination.
Prior and still-reserved units for the canonical observer.
Fixed combination rule and observer identity basis.
Exposure and uncertainty stay in observer history.
Compare new disclosure with prior and reserved exposure to the same observer.
Aliases share observer identity.
Prior/reserved units and prohibited combinations.
A new disclosure is evaluated together with prior and reserved exposure to the same observer.
Exact candidate with cumulative exposure result.
Matching approval, scope and expiry.
Actual supported route, stop state and cumulative limits.
Bind the admitted request before transport under all applicable limits.
Request, model, policy, expiry and stop state.
Call/byte bounds and approval; no grant inferred from available budget.
Available budget does not supply approval; all binding limits still apply.
One admitted reserved binding.
Carry the reserved work through the specifically qualified route.
Declared client/tool/descendant scope.
The original effect identity.
The transport is limited to its specifically qualified route and original effect identity.
Original issued identity.
Actual receipt/artifact or uncertainty.
Retain the returned artifact, source lineage and uncertain effects.
Received result and exact source/task binding.
Independent receipt or unresolved uncertainty without exposure refund.
Uncertainty does not refund possible exposure or authorize a replacement effect.
An illustrative method for comparing a selected view with observer history before an external task.
Additional mechanisms are described in the technical reference.
What the research says
Global average cost of a data breach, IBM’s 2025 and 2026 editions.
The global average cost of a breach rose from $4.44M to $4.99M, and IBM counted one in four malicious breaches as AI-enabled. These averages describe what an incident costs, not what any control saves. The architecture changes where an incident can start: an outside model receives only a permitted view, and a CISO’s policy decides which agent actions run, wait for a person or stop.61
An institution wants an external model to review one clause without exposing the full commercial agreement. A second request can reveal the missing relationship even when each fragment looks harmless alone. Synapse accounts for the observer across requests.
Admission records an immutable source snapshot, its ancestry, holder and origin. A tool result must retain the inputs from which it was derived.
Accounts map to a canonical observer. The ledger records which source units that observer has already seen and checks their combination with the proposed view.
Disclosure, effect identity and finite request bounds are reserved durably before transport. An interruption retains the exposure rather than resetting it.
A useful privacy architecture needs to know where a derived answer came from and which authority can release it. Synapse’s source graph and admission controls make that relationship explicit.
The source closure records selected files, buffers, instructions and tool-result ancestry. Session binding prevents an unrelated context record being reused as though it belonged to the current task.
Trust in an instruction and permission to disclose information answer different questions. Source labels and provenance survive derived context; a model-generated summary does not grant itself either property.
The selected architecture can keep a larger source local while preparing an admitted view for a defined computation. Deterministic transformations and locally retained assembly are separate from model transport.
A source graph and explicitly selected task view.
An inspectable projection and result lineage.
The supported profile defines which transformations and model routes are qualified.
The CISO sets what agents may do; the boundary checks each proposed action against it. Illustrative.
Illustrative situations, connected to the mechanisms that make them possible.
Institutions and R&D teams
A useful model needs context, while the organization holds a much larger sensitive source.
Software teams
A connection drops after a request may already have reached its provider.
Enterprises
A common application must reflect local permissions and operating context.
The broker reserves request bounds and the effect binding in a database transaction. Source, destination, model, policy, expiry and stop state are checked against the requested consequence.
One durable transaction binds the effect and accounts for cumulative call/byte bounds before transport. Concurrent attempts cannot spend the same unreserved allowance.
A received effect can reuse its matching receipt. If dispatch may have happened but no result is established, the record stays uncertain.
Recovery compares the existing binding and receipt. Abandonment does not erase earlier exposure or create a fresh allowance for the same information.
Stored application requests and model responses use authenticated encryption. Receipts expose the metadata needed for audit without copying plaintext into the receipt.
Agency Engine protects the application’s decision path. Metahive gives the deployment an explicit location, tenancy and operating responsibility. These compose with Synapse’s model-task boundary.
The sealed governance set includes approval, write, model-admission, disclosure and connector/store-custody services. Product extensions specialize around the declared set; the startup guard checks known bindings rather than providing process isolation.
Installation, organization and workspace context can tighten inherited policy. A product’s styling or local preference cannot widen its authority.
A deployment identifies where computation runs, who administers it, how sources are retained and which effects cross the boundary. Compute location is one part of that contract.
Metahive’s admission design reserves a maximum cost against tenant and site budgets before dispatch. Settlement records actual usage, while uncertain execution retains the reservation for reconciliation.
Context admission, provider transport, tools, descendants and recovery each contribute to the actual boundary.
Naevum’s architecture binds source identity, admission, human oversight and durable evidence around a supported task route. The commissioned profile specifies clients, tools, runtime identities, limits and recovery conditions. Native-client and operating-system containment need their own qualification.
In the synthetic document example, observer A may receive either fragment A or fragment B, but their combination violates the fixed rule. The same candidate is held after prior exposure and can be reserved without it. An interrupted admitted branch is reconciled under its existing identity. This demonstrates the mechanism without using a client’s document.
Inputs, retained state, outputs and limits of Naevum’s Security & privacy architecture.
It addresses part of custody. Sources, model access, logging, tool effects, administration and recovery still require an explicit deployment design and evaluation.
The decentralized label model distinguishes confidentiality and integrity policies. Synapse’s source ancestry, observer ledger and effect reservation provide specific controls around model work.
Source registration, disclosure authority and host execution are separate. An admitted context record does not by itself authorize transport, tools or a client’s direct route.
The deployment contract identifies supported model/client versions, tools, source transformations, custody and recovery. Native-session mediation and operating-system containment require their own installed evidence.
Authenticated payload storage, exact request binding and durable uncertainty address different failure modes. A dedicated compute location alone does not establish all of them.
If an email told your agent to move money tomorrow, where would your CISO want that request stopped?
Discuss a private AI architecture