ALEF LABS

SECURITY & GOVERNANCE

Permission is decided before evidence is read.

Alef applies access controls before retrieval, makes refusals visible, keeps facts distinct from predictions, and holds consequential action behind a named human gate.

Follow the control path ← Return to trust and deployment

Illustrative policy surface · exact controls are defined during technical scoping

VIEWER + SOURCE POLICY

Permission-scoped request

BEFORE RETRIEVAL

Access decision
● ALLOWEDSource-backed evidence
▣ WITHHELDRestricted source
A refusal becomes part of the answer instead of disappearing.

01 / PERMISSION ENFORCEMENT

Access is enforced before retrieval—not after the answer.

The viewer’s role and source policy determine what may be read. A disallowed source is refused at the retrieval boundary; Alef does not fetch it and redact later.

  1. 01

    PRINCIPAL

    Identify the participating role.

    Rina views operational cause and rollback evidence. Maya views affected accounts and renewal consequence.

  2. 02

    POLICY

    Evaluate source access before reading.

    The named policy for support transcripts is “Restricted source.”

  3. 03

    RETRIEVAL

    Read only permitted evidence.

    GitHub, PagerDuty, Amplitude, and Salesforce remain source-attributable.

  4. 04

    ANSWER

    Carry both evidence and refusal forward.

    The record states what was withheld and whether the absence changes the recommendation.

02 / WITHHELD EVIDENCE

A refusal is a first-class product surface.

Withheld does not mean missing without explanation. The artifact names the excluded evidence, the policy reason, and its effect on the recommendation.

▣ WITHHELDPOLICY AGENT · BOUNDARY

Support transcripts excluded by policy.

Reason
Restricted source
Retrieval
Refused before read
Substitute
No substitute inferred
Effect
Does not change rollout-pause authority

03 / MODEL + DATA BOUNDARIES

The loop remains inside the customer-controlled boundary.

The same boundary covers context assembly, inference, evidence, telemetry, approval, and action execution. It is not limited to where raw data is stored.

CUSTOMER-CONTROLLED BOUNDARY

DATA → DECISION → OUTCOME
01Shared contextTime-aware enterprise record
02Model inferenceObserved and predicted remain distinct
03EvidenceSource identity stays attached
04TelemetryRemains inside the boundary
05ApprovalsNamed human decision
06Action executionControlled destination + receipt
The shared context, model inference, evidence, telemetry, approvals, and action execution remain inside the customer-controlled boundary.

04 / DEPLOYMENT

Runs where your data lives.

VPC, on-prem, and air-gapped are the deployment modes in the product corpus. Each mode carries the same customer-controlled-boundary requirement.

01

VPC

Customer-controlled boundary

02

On-prem

Customer-controlled boundary

03

Air-gapped

Customer-controlled boundary

Shared context · Model inference · Evidence · Telemetry · Approvals · Action execution

05 / AUDIT + TELEMETRY + PROCUREMENT

The control record is inspectable; unspecified controls stay unspecified.

Audit and telemetry remain part of the governed record and customer boundary. Update paths and support access are resolved in technical scoping, not replaced by universal claims on this page.

AUDIT REGISTER

What remains attached

  • EvidenceSource ID · source time · epistemic class
  • PermissionAllowed evidence · named refusal · effect
  • DecisionNamed human · authority · reversal
  • ExecutionControlled destination acceptance
  • OutcomeObserved result in the same record

TECHNICAL SCOPING REGISTER

What is customer-specific

  • UpdatesExact update path defined during technical scoping
  • SupportExact support access defined during technical scoping
  • ControlsNo certification or universal control is claimed here

— UNSPECIFIED UNTIL SCOPED

06 / GOVERNANCE IN THE PRODUCT

The governance record is visible where work happens.

These are unedited captures from the live product. The workspace exposes the retrieval boundary and the pre-write action gate inside the same decision context.

Alef product Trust boundary stage showing searched, used, withheld, freshness, permission, and abstention records beside the governed claim register
FROM THE PRODUCT · TRUST BOUNDARY What was searched, used, withheld, and why remains in the record. Live local product · dark theme · 1440 × 900
Alef product Action stage showing a proposed intervention with decision authority, expected consequence, budget boundary, and reversal path before an external write
FROM THE PRODUCT · PRE-WRITE ACTION GATE Authority, consequence, budget boundary, and reversal precede execution. Live local product · dark theme · 1440 × 900

07 / HUMAN APPROVAL + REVERSAL

Consequential action crosses one explicit human gate.

An agent can propose a bounded intervention. Nothing executes until the named authority reviews the evidence, policy boundary, expected consequence, and reversal.

PROPOSAL

Bounded intervention proposed.

NOTHING EXECUTED

NAMED HUMAN

Authorized decision owner required.

HUMAN GATE

REVERSAL CONTROL

Measurable reversal condition attached.

ATTACHED

Evidence → Approval → Execution → Reversal → Outcome

Follow the full decision and receipt lifecycle on Product
Bring one real cross-system problem to the technical evaluation