The model is never the gatekeeper.
Most AI systems control access the polite way: they retrieve everything and ask the model to please not reveal the wrong things. That's a request, not a control, and every jailbreak is a reminder of the difference.
Yohanun decides access before generation, deterministically. Permissions are compiled into the retrieval query itself, so memory a principal isn't cleared to see never reaches the model at all. There is nothing to jailbreak out of a context that was never there.
One request, end to end
1 · IDENTIFY
The request's principal is resolved. For managed principals the platform's ledger is authoritative; asserted permissions are ignored.
2 · COMPILE
Clearances, ownership and classification limits are compiled into the vector-store query as hard filter conditions.
3 · RETRIEVE
Only memory that passes every wall comes back. Labels live in metadata, not content, so there is no marker for a model to overlook.
4 · GENERATE
The model answers from context that was already permitted. Its intelligence is spent on the answer, not trusted with the access decision.
5 · RECORD
An append-only audit row records the gated read: who asked, what gate applied, what was released.
Four questions, answered by ledgers
Every governance decision reduces to one of four questions. Each has its own enforcement mechanism, and each mechanism is a ledger: append-only, instantly effective, independent of the data it governs.
Who can see: clearances
Matter-level and classification-level clearances, held in a platform-owned ledger. Revocation takes effect on the next request. No re-indexing, no cache purge ceremony. Grants are conflict-checked against an authority graph, so a clearance that would cross an ethical wall is refused at grant time, not discovered at leak time.
Who owns: personal walls
Tenant isolation is the unconditional outer wall. Inside it, memory can belong to a person: owner-labelled memory returns only to its owners, enforced in the same query gate as everything else. Derived artifacts such as summaries and stored answers inherit the strictest labels of their sources, so nothing derivative is ever more visible than what it came from.
Who holds: custody
Ownership keys separate what a memory is from who currently holds it. Share, revoke, or transfer custody (a departing staff member's matter handed to a successor) as one ledger row, effective immediately, with the data itself untouched. Custody moves; provenance is never rewritten.
Who can act: mandates
Agents act up to a mandated limit; anything over it, or outside any mandate, escalates to a human decision queue instead of failing silently or, worse, proceeding. Every authorization and escalation lands in an action audit trail.
Failure is a design decision
When infrastructure degrades, the system splits deliberately: commits fail closed, meaning an action that can't be authorized doesn't happen, while reads degrade gracefully, so an outage never turns into either a data leak or a dead product. The distinction is engineered per operation, not left to whatever the exception handler happens to do.
And history is never edited. A wrong memory is superseded by its correction; a finished task is closed; both remain readable by id with their full lifecycle trail. The record stays honest because mutation isn't in the vocabulary.
The one exception is deliberate: governed erasure. When a client, a retention policy or data-protection law requires destruction, a purge resolves the target to a content-free plan, a mandate or a human approval authorises exactly that plan, every store is scrubbed, and each erased memory leaves a tombstone row. Nothing is lost by accident; erasure is an act with a permission check and a receipt.
The selector can be one memory, one document, one person, one compartment at the end of its retention, or the whole tenant. An erasure above what a clerk may authorise waits for a second person, named: the platform refuses a decision from whoever asked. The words the erased person asked leave the audit and retrieval logs with them, while the rows stay. And the receipt says what a purge does not reach: backups are not rewritten, and it states when they expire. What an erasure has to reach.
What the auditor sees
- · One append-only row per gated read: who, what gate, what was released
- · Every clearance grant, revocation, and refused-for-conflict grant
- · Every custody share, revocation, and transfer
- · Every action authorization, escalation, and human decision
- · Every memory's lifecycle: created, superseded-by, closed, regraded, purged, and why
- · Every refused grant, as a durable record: who, into which compartment, against which
- · What the estate held on any past date, with what has happened to each item since
- · The whole estate, every memory and every ledger row, as one export, under mandate
These aren't logs assembled after the fact. The enforcement mechanisms are themselves ledgers, so the audit trail is the system rather than a report about it.
An AI that can be cross-examined.
What an AI system remembered, and when, is already discoverable. The fear is not that it forgets; it is that its record, produced in a dispute or to a regulator, cannot be accounted for. Yohanun's record can. Ask what the system knew on the day it gave an answer, and it answers from the ledger, not from what it knows now.
Every answer is stored with the sources that grounded it and which of them it cited. Every read has a row. Every change to a memory is an event with a reason. Every refusal is a record. And the whole estate can be produced as one stream, under the same mandate discipline as erasure, so that what is handed over is what was held.
The questions it can answer under oath
- · What did the system hold on 5 March, and what has happened to each item since?
- · Which sources grounded this answer, and which did it cite?
- · Who read this compartment, when, and what were they cleared for at the time?
- · Who was refused access, into what, and why?
- · Who authorised this erasure, what did it reach, and what did it not reach?
- · Was the person asking who the application said they were?
Each of these is an endpoint, not a report assembled afterwards. What it will not do is the other half of the same page.
Architecture, not badges
This page describes enforcement mechanisms, not certifications. We're an early-stage platform: we don't yet hold SOC 2 or ISO attestations, and we won't imply otherwise. What we offer instead is an architecture built to be examined, and a standing invitation to examine it.
If you're evaluating Yohanun for regulated work, bring your security team and your hardest questions. The deterministic gate is easier to review than a prompt. That is rather the point.
Talk to us about a review