The AI never decides. That is wiring, not a disclaimer.
Sentanis never denies a claim, rejects a demand, contacts a claimant, files with a court, releases a document, or signs anything. Two further things have to be true for that to mean something: the model has to resist prompt injection, so a hostile letter cannot steer it, and it has to be protected against hallucination, so a fabricated citation cannot reach a signature. Here is how each is built. How claim data itself is protected, from intake to decision, is on the security page.
Prompt injection
A hostile letter cannot steer the model
A demand letter is written by someone who would like your system to do what it says. So would a claimant's email, a clinic's records, or a web page a research call happens to find. Trust and capability policy live in one central package, and every model path runs through it.
One gateway for every model call
Every request to a model provider passes through a single gateway with a registered task profile. Tools the profile did not declare, and provider-built-in capabilities, are refused before anything leaves the building. An architecture test fails the build if new code reaches a provider any other way.
Policy no prompt can override
The safety policy is immutable and sits outside every configurable task prompt. A workspace can customize what a task does; it cannot replace, suppress, or weaken the policy that governs it.
Evidence is labeled evidence
Correspondence, attachments, OCR text, photos, imported notes, tool results, and the model's own earlier output all enter a call explicitly labeled as untrusted evidence, with their source lineage attached. Nothing acquires the authority to instruct by being copied, summarized, or saved.
Capabilities checked at the moment of use
Before a tool runs, the system checks the tool set actually offered and the claim scope the application granted the person. Arguments written by the model cannot widen that scope to another claim, switch a find into an analysis, or turn on a write.
A report needs a person to ask for it
Saving a report requires both the permission to write reports and an explicit request from the person in that turn. The control defaults off and resets when the scope changes; the save path checks again before anything persists.
Legal research runs in quarantine
The call that reads a draft has no web access. Public-law lookups run in a separate call built by the server from a catalog of authority families and bounded citation coordinates. It carries no draft prose, no party names, and no conversation history, and it is capped at six lookups, three searches each, thirty seconds in all. What comes back is evidence, never instruction.
Receipts without content
Safety telemetry records which profile, policy, and outcome applied. It never records evidence, prompts, queries, filenames, identifiers, or model prose.
No silent discards
No detector may quietly drop a piece of correspondence or the deadline inside it. A letter that looks hostile still reaches the queue, still gets read, and still gets calendared.
Hallucination
A made-up citation cannot reach a signature
More than 1,500 court decisions now involve fabricated AI citations. Sentanis treats a citation as unproven until a deterministic check has found the source, the passage, the pinpoint, the jurisdiction, the date, and the treatment history, and has bound that proof to the exact draft counsel is looking at.
The model judges; the server decides
An independent assessor, on a separate lineage from the drafting agents, may report a proposition as supported, contradicted, or unchecked. It cannot manufacture a source, a quotation, a pinpoint, a fingerprint, or currency. Deterministic server checks turn its judgment into a status.
What it takes to be called verified
One unique source with an allowed canonical identity. A credential-free HTTPS location. Complete, versioned source text. A passage present in both the full text and the cited pinpoint. Matching jurisdiction, a governing legal date, and current non-adverse treatment. A supported proposition with independently grounded facts. An exact excerpt from the draft being checked. Missing any one of these, the finding is needs-review, not verified.
A draft may cite only what it was given
Generated or edited drafts can cite only canonical authorities present in the supplied source set. Unknown, ambiguous, or incompletely sourced citations go to counsel for review rather than into a letter.
Every sentence is inventoried
The verifier numbers every unit of the draft. Each must be classified legal or non-legal, every legal unit must have a finding tied to it, and every explicit citation is reconciled by canonical identity and exact wording. One paragraph cannot vouch for another, and a repeated proposition cannot hide behind a single proof.
Proof is bound to a revision, and it expires
A proof binds the policy version, the draft's content fingerprint, the jurisdiction and date context, the source fingerprint, retrieval time, and check time. Change a word of the letter, the source, or the policy, and the proof is void. A source approaching a day old at review time does not get another day of approval.
Facts must be established, not alleged
Applying an authority to this claim requires every factual premise to be tied to independently established, human-reviewed evidence with document and extraction revisions. Alleged, disputed, or unknown facts withhold approval.
Verified is evidence for counsel, never a signature
A passing check states the evidence condition of a finding. It does not authorize sending, filing, settling, releasing, or advising, and it does not replace counsel's review. The system fails closed when authority evidence is unavailable or incomplete.
What this does not claim
The specifications these controls come from state their own limits. So does this page.
- These controls constrain what a manipulated model can do. They do not make a model immune to manipulation, and no measured attack-success rate against live models is claimed yet; that evaluation is planned separately.
- The citation verifier's tests are deterministic and synthetic. They prove the mechanics, not a real-world hallucination rate, and they are not a counsel-reviewed corpus.
- Legal approval that depends on a full-text authority source with treatment history stays needs-review until a reviewed production source is connected. The first bounded transport covers a fixed set of California statutes.
- Voice intake, OCR transport, browser rendering, and operating-system controls are separate boundaries with their own owners; the model gateway does not cover them.
- The central gateway described above is in final security review and not yet released. Until it merges, route-specific authorization and the human gates carry the load; the independent security review says the same.
- No compliance certification is held. The controls are mapped to recognized frameworks, and the design assumes a court or a regulator may one day read the record.
Bring your security team to the demo.
We will walk the gateway and the verifier on a fictional file, and answer the questions a review would ask.