The model is never the gatekeeper.
Most AI systems control access the polite way: they retrieve everything and ask the model to please not reveal the wrong things. That's a request, not a control, and every jailbreak is a reminder of the difference.
Yohanun decides access before generation, deterministically. Permissions are compiled into the retrieval query itself, so memory a principal isn't cleared to see never reaches the model at all. There is nothing to jailbreak out of a context that was never there.
One request, end to end
1 · IDENTIFY
The request's principal is resolved. For managed principals the platform's ledger is authoritative; asserted permissions are ignored.
2 · COMPILE
Clearances, ownership and classification limits are compiled into the vector-store query as hard filter conditions.
3 · RETRIEVE
Only memory that passes every wall comes back. Labels live in metadata, not content, so there is no marker for a model to overlook.
4 · GENERATE
The model answers from context that was already permitted. Its intelligence is spent on the answer, not trusted with the access decision.
5 · RECORD
An append-only audit row records the gated read: who asked, what gate applied, what was released.
Four questions, answered by ledgers
Every governance decision reduces to one of four questions. Each has its own enforcement mechanism, and each mechanism is a ledger: append-only, instantly effective, independent of the data it governs.
Who can see: clearances
Matter-level and classification-level clearances, held in a platform-owned ledger. Revocation takes effect on the next request. No re-indexing, no cache purge ceremony. Grants are conflict-checked against an authority graph, so a clearance that would cross an ethical wall is refused at grant time, not discovered at leak time.
Who owns: personal walls
Tenant isolation is the unconditional outer wall. Inside it, memory can belong to a person: owner-labelled memory returns only to its owners, enforced in the same query gate as everything else. Derived artifacts such as summaries and stored answers inherit the strictest labels of their sources, so nothing derivative is ever more visible than what it came from.
Who holds: custody
Ownership keys separate what a memory is from who currently holds it. Share, revoke, or transfer custody (a departing staff member's matter handed to a successor) as one ledger row, effective immediately, with the data itself untouched. Custody moves; provenance is never rewritten.
Who can act: mandates
Agents act up to a mandated limit; anything over it, or outside any mandate, escalates to a human decision queue instead of failing silently or, worse, proceeding. Every authorization and escalation lands in an action audit trail.
Failure is a design decision
When infrastructure degrades, the system splits deliberately: commits fail closed, meaning an action that can't be authorized doesn't happen, while reads degrade gracefully, so an outage never turns into either a data leak or a dead product. The distinction is engineered per operation, not left to whatever the exception handler happens to do.
And history is never edited. A wrong memory is superseded by its correction; a finished task is closed; both remain readable by id with their full lifecycle trail. The record stays honest because mutation isn't in the vocabulary.
What the auditor sees
- · One append-only row per gated read: who, what gate, what was released
- · Every clearance grant, revocation, and refused-for-conflict grant
- · Every custody share, revocation, and transfer
- · Every action authorization, escalation, and human decision
- · Every memory's lifecycle: created, superseded-by, closed, reason
These aren't logs assembled after the fact. The enforcement mechanisms are themselves ledgers, so the audit trail is the system rather than a report about it.
Architecture, not badges
This page describes enforcement mechanisms, not certifications. We're an early-stage platform: we don't yet hold SOC 2 or ISO attestations, and we won't imply otherwise. What we offer instead is an architecture built to be examined, and a standing invitation to examine it.
If you're evaluating Yohanun for regulated work, bring your security team and your hardest questions. The deterministic gate is easier to review than a prompt. That is rather the point.
Talk to us about a review