Platform
Every role in the decision loop gets its own surface, and every surface reads the same case ledger. Signed in through your identity provider, running entirely inside your data centre.
The intake surface: sources with their health, incoming documents, and the case record with fields marked read or please verify.. The proof-record registry: records with their verification status, searchable by case, date, outcome and actor..
The surfaces
Case officers, senior reviewers
Evidence first, a suggestion marked as a suggestion, the outcomes the machine is licensed to act on, and a decision that becomes a record. Hold with a reason; hand to a senior with the why attached.
BoundaryReads masked case data for its own assignments; unmasking is a permissioned, audited act. Nothing on this surface leaves the appliance.
Intake operations
What is arriving, from where, and what could not be read. Source health per connector, an incoming queue by language and age, and a hold queue for low-confidence fields.
BoundarySees documents and field confidences as states; raw payloads stay on the node that received them.
Compliance, head of risk
Are we within the standard? Agreement with the machine in shadow mode, the calibration in force, drift, known wrong actions, and every case the machine declined to decide.
BoundaryReads model scores and calibration, gated to compliance and risk roles; never shown to a reviewer.
Compliance, audit, head of risk
Every decision, searchable by case, date, outcome, actor and key. Verification status per record, key history, and exports: JSON, PDF, an offline verification bundle, the regulator-facing subset.
BoundaryRead by compliance, audit and risk; export crosses the boundary only through the write-once path with a manifest.
IT administration
Installed workflows with their mode and rollout ring, promotion under dual control, connectors, key custody and rotation, the air-gap probe, and who is mapped to which role.
BoundaryHolds custody policy for keys it can never read; the private signing key is generated in hardware and never leaves it.
Branch staff, IT
When the core is unreachable the branch keeps deciding within its licence: outbox depth and age, armed or stale, local records, and the reconciliation list when the core returns.
BoundaryKeeps deciding within its licence with no core link; local records and an outbox drain inward when the link returns.
Role to surface
Roles come from your directory groups through your identity provider. The console never gates anything itself; the server hands each role only the objects it may see.
| Surface | Reviewer | Compliance | Head of risk | Auditor | Intake operations | Operations manager | IT administration |
|---|---|---|---|---|---|---|---|
| Review | Decides | Policy + override | Read | Read | Read | Read | — |
| Intake | Read | Read | — | — | Works cases | Read | Health only |
| Oversight | — | Policy + override | Reports | Exported view | — | Read | Health only |
| Proof records | Own records | All + export | All + export | All + export | — | — | — |
| Administration | — | Read | Read | Exported view | Health only | Read | Full control |
| Branch console | Decides in degraded mode | Read | — | — | — | Read | Health only |
Depth-three detail, such as model scores, is gated by role, never by a click. Reviewers never see a probability.
Deployment and integration
One web application inside your perimeter, no path to the internet. Branch appliances keep deciding within their licence when the core is unreachable.
LDAP, SAML or OIDC. Directory groups map to roles in signed configuration; the mapping is visible to administrators and nobody else.
Evidence, the constrained decision form and the proof viewer are one component. The standalone console uses it; your existing case manager can host it. REMIT owns the gate and the record; you own the queue and the customer.
Single site with one workflow; regional with several branches and workflows; group with multiple entities and geographies. Sizing is agreed in Discovery.
Status. The console and its six surfaces are built and demonstrable; the embeddable panel is a specified contract for the next release. Design-partner deployments run as forward-deployed engagements.
The console can be walked through in an hour. Two weeks in shadow mode on your own servers is the next step.