Advice and permission, kept apart

One request, start to finish

A request names a document, a recipient, optionally an approval reference, and a free-text message. The server owns every fact about documents, recipients and approvals. Nothing in the request can change them.

1. Scope comes first

Code checks the sender, document and recipient against the operator’s registry. A restricted document, an unknown recipient or an unapproved vendor is denied immediately. The model is never called and intent is never guessed, so no wording can argue past it.

2. Muse investigates, within fixed bounds

Meta’s Muse receives the request as JSON-encoded, untrusted data. It may call three read-only lookups: lookup_approval, get_document_facts and get_recipient_facts. After four tool calls or four model calls it must answer. The worst-case cost of each call is reserved against a spend cap before the call is made.

3. Evidence is checked by code

The answer must match a strict schema. A threat finding becomes BLOCK only if code confirms everything it cites: quotes must appear in the request, and registry, document and recipient claims must match the server’s own records. A finding that can’t be confirmed is held for a person, which turns a possible false positive into a review instead of a refusal.

4. Policy decides

policy.py is the only code that can return ALLOW, and only when every check passes explicitly. The absence of a denial is never enough. A missing or unknown approval is treated as uncertainty and held, not as proof of forgery.

5. Delivery and receipt

An allowed request produces exactly one item in a local outbox, bound to the approved bytes and destination. Every outcome writes a durable receipt. Duplicate, concurrent and crash-and-restart behavior is covered by system tests.