Governance your auditors can recompute
Every projection, grant and interaction folds into a hash-chained journal. Fold it again under the same parameters and the digest matches byte for byte. Nothing is self-reported by the process that did the work.
Separated control plane
Purpose profiles, consent grants and attestation live in a control plane the model cannot reach. The MCP server can read a projection and record what was done with it. It cannot widen its own access.
Cross-border by policy
A transfer policy per jurisdiction gates every node before it crosses a border. A projection served in Texas and one served in Frankfurt differ by policy, not by configuration drift.
Keyed human attestation
Obligations and relationships become load-bearing only when a registered signer attests them with an Ed25519 receipt. Proposed items stay visibly proposed until then.
Deploy where the data lives
Dedicated cloud control plane, your VPC, or fully on-premises. Journals stay in your custody; verification runs anywhere the digest does.
Interaction records
Every consequential model action, refusals included, is written as metadata to the journal. Governance that records what the system decided but not what the model did has a hole in the middle.
Signer registry
Bring your own key registry. Rotate signers, revoke receipts, and keep a chain of custody from the person who attested to the projection that relied on it.