Capture
A structured conversation, usually by voice, that a professional will actually complete. The output is data with provenance, not a transcript.
Where we fit
The bottleneck is no longer model access.
The bottleneck is no longer model access.
It is governed operationalisation.
The leading firms have finished the first problem. A platform is chosen, the licences are deployed, the pilots are running, and someone senior owns the strategy. The question that follows is harder and lands squarely on IT: what governs the agents that now run on top of it, and what evidence exists that the governance held.
That is the layer we build, and it is not another drafting tool.
What we do not do
We are not in the room your platform is already in.
We do not do firmwide drafting, research or document review, and we have nothing to say about the platform a firm has chosen for them. That decision is made and it is not ours to reopen.
We work one layer out. The knowledge that never reaches a document in the first place, because it was spoken in a pitch debrief, a client call, a matter close or a partner review, and then lost. The constraints an agent operates under once it is allowed to act on privileged data. The record that lets you answer a client, a regulator or your own risk committee months later. Those are separable problems, and a firm that has solved the first one still has these.
Containment
What the agent may reach, what it may do, and what it may send, bounded at the type level rather than requested in a prompt.
Evidence
An append-only record of what was captured, what was inferred, who approved it and what the system was permitted to do at the time.
Reference shape
One path, six gates, nothing implicit.
Every deployment is configured to a firm's own estate, so treat this as the shape rather than the diagram. What does not vary is that each arrow is a checked boundary.
| Stage | What happens | What is checked at the boundary |
|---|---|---|
| 1. Identity | The person signs in through your own identity provider. No separate account estate. | who · tenant, role, and the records that role may see |
| 2. Capture | A structured conversation, by voice or text, that reads back what it heard before anything is persisted. | consent · nothing is stored the speaker has not confirmed |
| 3. Grounding | Every assertion is anchored to the source it came from. If the source is absent, the claim is not made. | provenance · source, when it was true, when last checked |
| 4. Constraint | The agent acts inside a bounded capability set. Retrieved content is data, never instruction. | capability · reach, authority and budget, all bounded by type |
| 5. Approval | A named human accepts, edits or declines. Declining is a first-class outcome that is recorded, not a failure. | authority · who signed, on what version |
| 6. Write-back and record | The result lands in your system of record; the trail lands on an append-only log. | egress · destination, payload shape, retention |
Deployment shape, region and data store are the firm's to nominate, and changing them changes cost and timeline in bounded ways rather than changing the product. Which model and voice providers we support is published rather than negotiated per deal, so you can check it before you talk to us: see Security and the Trust Centre.
The same system, three evaluations
Three people have to say yes, and they are not asking the same question.
For the IT leader
What does this change about how the firm operates?
Capture moves from a chore nobody completes to a conversation that takes minutes. The output is structured data your existing systems can consume, so the value is not another interface for lawyers to learn. Adoption is the metric, and voice is the modality with the lowest activation energy in a professional services firm.
operating change, not another toolFor the enterprise architect
Where does it sit, and what does it touch?
It sits between the people and the systems of record, not between the firm and its model provider. Identity comes from your tenant. Data stays in a store you nominate. Every handoff between one step and the next is typed, so what crosses a boundary is checked rather than assumed. It composes with the platform you have chosen; it does not sit in front of it.
typed boundaries, nominated store, your identity providerFor information security
What is the closure of what this can do?
The question we design to is not only "is the code correct" but "what is the complete set of things this agent can reach, and does it intersect what it must never reach". Capability is bounded by construction rather than by prompt, retrieved content is treated as data and never as instruction, and every action lands on an append-only record. Containment is a property to be proved, not a behaviour to be hoped for.
bounded capability, gated egress, append-only record How the containment claim is made good
Proved, not asserted.
A policy document says an agent must not cross a tenant boundary. A proof says it cannot. Our hardest safety logic is written in Lean 4 and checked by its kernel, so properties like tenant isolation, non-escalation of authority and gated egress are theorems rather than intentions, and the proof gate blocks the deploy.
We also state the limit plainly, because a vendor who will not is not one you should trust on this subject. A kernel checks code against a specification a human wrote. It never checks that the specification encodes what was actually wanted. Formal methods relocate judgement rather than removing it. That relocation is real, valuable and finite, and we would rather you hear it from us.
-- Containment is a property of the system, not of the prompt. theorem no_cross_tenant (a : Agent) (r : Resource) :
reachable a r → tenant r = tenant a := by
exact capability_closure a r
-- Two individually safe agents can compose into an unsafe one. theorem coalition_safe (C : Coalition) :
(∀ a ∈ C, safe a) ∧ disjointAuthority C → safe C := by
exact compositional_containment C
✓ the proof gate blocks the deploy
Illustrative of the shape of the obligation, not a copy of our source. We will walk an architect through the real theorems and the gate that enforces them, under NDA, in a technical session.
Before we propose anything
The questions we would want answered first.
We do not know your estate, and a vendor who tells you where your gaps are before asking is guessing. These are the questions we would actually ask, published here so you can see the shape of the conversation before you have it.
- Which of your agent workflows currently has a human approval step, and which has quietly stopped having one?
- When a client asks how you assure the behaviour of AI on their matter, what artefact do you hand them today?
- Where does the knowledge from a client conversation, a pitch debrief or a matter close currently go, and who reads it?
- If an agent took an action it should not have, how long would it take you to find out, and what would the evidence look like?
- Which parts of your estate are you contractually able to point a new capability at, and which are closed?
If the honest answer to most of these is that the firm already has it covered, we will say so and we will not propose anything. That is a better outcome for both of us than a pilot that should not have started.
What a first step looks like Narrow Bounded Falsifiable
One workflow, one team, one falsifiable measure.
We do not open with a firmwide proposal, because nobody should buy an assurance layer on a first conversation. We open with a single capture workflow, a named group, and a threshold agreed in advance that decides whether it worked. If it does not clear the threshold, it stops, and we say so.
One workflow
A capture workflow the firm already needs and currently completes by email and interview.
One group
A defined set of people, inside your tenant, with a defined data boundary. Nothing firmwide.
One measure
A threshold set before the work starts, so the result can come out negative and everyone knows what that means.
| What to measure | Why this one | Set the threshold before you start |
|---|---|---|
| Completion rate | Capture tools do not fail on quality, they fail on nobody finishing them. This is the honest leading indicator. | % of the group who complete, unchased |
| Time to complete | The number the participants themselves feel, and the one that decides whether it survives contact with a billing target. | minutes per person per cycle |
| Rework by the reviewer | Output that a human has to rewrite has moved work rather than removed it. This catches the failure that adoption metrics hide. | % of output edited before acceptance |
| Evidence completeness | The assurance half. Either every accepted item has a source, an approver and a permitted-capability record, or it does not. | % of items with a complete record |
We deliberately publish no benchmark figures here. Numbers from another firm's estate would not predict yours, and a vendor quoting an uplift percentage without naming the method is telling you nothing you can check. Set the thresholds against your own current baseline.
Check us without us
The foundations are public.
We are a small team making unusually strong claims, so we publish the basis for them. None of the following requires a conversation with us, an NDA, or a form. Read it first and decide whether a meeting is worth your time.
The engineering standard →
The bar we hold ourselves to, written out in full, including the limits of what formal methods can and cannot do.
The stack architecture →
Ten formally connected layers, from a Lean 4 substrate of game theory and mechanism design up through agent orchestration, compositional safety and legal reasoning.
LegalLean →
Machine-checkable legal reasoning that marks explicitly where law is provable and where human judgement must enter.
Proof-Carrying Coalitions →
Proving that a group of individually safe agents cannot jointly reach a forbidden capability. Two safe things can compose into an unsafe one.
The Open Compliance Foundation →
Compliance evidence as typed, machine-readable chains rather than documents, developed in the open as a standards library.
The essays →
The ideas worked through in public, including why the cost of verification rather than emission is what now binds engineering teams.
Product, pricing and security detail live on the rest of this site: Agents · AI Grounding · The Stack · Security · Pricing · Thinking. Live certification status, policies and sub-processors are published in the Trust Centre, which is the source of truth rather than this page.
The right first meeting is with your architects.
Not a demo and not a pitch. Forty five minutes on integration surface, tenancy boundary and what an agent is permitted to do, with the people who would have to live with the answer.