A human decides. Always.

No autonomy where it counts

There is no code path in the platform that converts a detection into an engagement. Detections become events; events become inbox items; inbox items wait for a human. That chain has no shortcut, no configuration flag, no “advanced mode” that skips the person.

This is not a policy laid over a capable machine. It is an absence: the machine was never given the ability, so no policy change, misconfiguration or compromise can grant it later.

Need to know, by construction

Not everyone should see everything. Sensor rows carry clearance tags, theaters scope what each organization may access, and anything outside a user’s scope simply does not exist for them — enforced in the database, not in the interface.

For the exceptional moment when someone must see beyond their scope, break-glass access exists — but it demands a written reason first, notifies, and writes everything seen into the immutable record. Emergency access and unaccountable access are not the same thing.

An immutable record

Every consequential action — who saw an event, who acknowledged it, who exported an evidence pack — is appended to a hash-chained audit trail. Entries cannot be edited or quietly deleted; tampering with one entry breaks the chain for all later ones.

Accountability that depends on goodwill lasts until the first incident. Accountability that depends on mathematics lasts through it.

No mass surveillance

A platform that watches sectors must not become a platform that watches populations. Human voices are discarded on-device before anything is transmitted; faces and license plates in imagery are blurred by default.

The system is pointed at threats in defined areas under defined authority — not at everyday life. That boundary is drawn in the architecture, reviewed in the open, and non-negotiable in deployment.

• Voices discarded on-device — never transmitted, never stored
• Faces and plates blurred in imagery by default
• Collection bounded by theater, authority and audit