Territory Grounder · Field guide
What the safeguards do — and where they stop
Reviewed 2026-11-02. Governed remediation is implemented. Fresh installs start in Shadow: read-only, with no actuation targets. Three repairs demonstrated in an isolated lab; broad production effectiveness is still being evaluated.
Before an action
An action must pass the mode chokepoint, policy and risk checks, a prediction bound to its action hash, and the configured effect adapter. An absent or invalid mode fails closed to Shadow. An empty actuation allowlist permits no target.
The never-auto floor excludes dangerous or unrecognized operations from automatic execution. Stateful-workload detection includes name-based heuristics. A database hidden behind an unusual service name can evade that heuristic. Only explicitly allowlist workloads you have established are appropriate for the operation.
Approval is configuration-dependent. Eligible actions can run without a human vote. The lab recording uses an autonomous fallback for novelty; that does not waive other holds. See the operator quickstart and governed behaviors.
After an action
Deterministic code, separate from the acting model, scores the observed outcome. A verification deviation trips the durable breaker and forces Shadow. It is a control over the decision path, not a guarantee that telemetry is correct: missing observations, sensor failures and shared blind spots remain possible.
Commit-confirm undo is available for supported action paths. It is not a universal rollback guarantee. Validate the exact adapter, its confirmation signal and its failure behavior in an isolated environment before granting effects.
What the ledger protects
The decision spine is hash-chained. The runtime database role lacks UPDATE and DELETE on append-only records. This constrains the application process and makes tampering detectable when the chain is checked.
A database administrator or host owner has stronger authority than that runtime role. Protect migration credentials, backups and independent evidence anchors; do not treat an internally consistent chain as proof against every privileged attacker. Read the threat model and database migrations.
Data and models
Self-hosted means you operate the platform. It does not mean every configured dependency stays on your machine. A remote model provider receives the prompt, context and evidence sent to it; chat, ticketing and telemetry connectors have their own destinations.
A suitable local model gateway can keep inference local. An air-gapped deployment also needs local images and dependencies, reviewed connector settings, and verified network controls. The website does not claim that the default evaluation bundle establishes those controls.
Evaluate the boundary yourself
Start with a disposable environment, read-only credentials, one alert source and an observable target. Check that missing credentials and out-of-scope requests are refused, and that the recorded prediction and verification agree with independently observed state. Follow the operator documentation before enabling effect permissions.