This page sets out where AI enters your work, what it is never allowed to do whatever the circumstances, and what is recorded about every run. We publish it because selling governance without disclosing it is a contradiction.
In effect from
The difference between a studio that uses AI and a studio hiding behind it is these two columns: what the model is allowed to do, and what it is not allowed to do however tight the deadline gets.
Each model run has a ledger entry in the platform. These are its actual columns, not a description of them.
| Field | What it means |
|---|---|
| Provider and model | Which provider ran the request, and which model by name. |
| Agent version and prompt version | The version that ran, with the template identified by a checksum rather than by its text. |
| Linked entity | A reference to the item worked on, not a copy of its content. |
| Units and cost | What the run consumed and what it cost. An internal figure that does not appear in your interface. |
| Latency and outcome | Succeeded, provider error, output that failed its required schema, budget ceiling exceeded, or fell back to another provider. |
| Human-corrected | A flag saying a reviewer edited the output. It is what feeds our quality measurement. |
| Correlation id | Ties the run to the request that triggered it, so an incident can be traced end to end. |
Because we sell human judgement rather than production speed, and anyone selling governance should write its limits on a public page they can be held to later.
So, plainly: yes, AI is used to produce your work. The draft is automated. The decision is not.
Where the service is advisory by nature — a plan, a negotiation, a crisis — the work stays human from the start.
Only what the task needs is sent at all, and one client’s data is never sent inside another client’s context. Stated plainly: automatic classification of data before each call is not built yet, so today the limit is what the call itself passes rather than a classification layer inspecting it.
Our processing agreements require that your data is not used to train a provider’s models, and the agreement in force with each provider is available to you on request.
The run entry keeps the provider, the model, the purpose, the outcome and the cost. Sensitive prompt content is not written into general logs; the prompt template is identified by a checksum, so we can prove which text ran without storing that text in every record.
Internal diagnostics, cost, margin and prompt content do not appear in the client interface. That is separation rather than concealment: what belongs to you is the deliverable and the name that signed it, not the bill for our tooling.
Every capability runs through an adapter, so it can move to another provider without changing your data, the workflow, or anything you see. Provider selection weighs quality, latency, language, cost, and the processing restrictions your sector imposes.
Restricting which providers are permitted is, today, platform configuration — not a per-client policy and not a clause in your contract. It is written that way because describing it as a capability you hold would have this page promise what the code does not enforce.
Comments, rejections and corrections enter a learning log that cannot be edited once written. Repeated patterns become a proposed rule, and a proposal does not become a rule until someone with authority validates it.
That is what stops an offhand comment on a bad day from becoming a permanent rule about your brand.
The risk tier decides the reviewer: standard goes to the service lead, elevated to the account lead, regulated to a compliance reviewer, and a crisis to a partner. The rule is enforced in the permission matrix, and a lower role cannot approve a tier above itself.
An agent version does not become the working version until it has passed recorded quality evaluations, so an update does not ship merely for being newer.
It does, and it sometimes invents facts that look sound. That is why its output is never published as it stands, and why the signature exists at all.
If you spot an error in delivered work, tell your account owner: the item is pulled and a correction is opened against the run that produced it, so the mistake stays traceable instead of being fixed quietly.
One sentence, and it is enforced in the database rather than in a document. Everything above explains how we get there, and who carries the responsibility when we do.
Questions about this document, or a request about your own data: hello@grokerz.com