Skip to content
HONESTASDecision-Evidence Operating System

For the Chief Risk Officer

One model produced the answer, and nothing else checked it before it took effect.

A second opinion in most AI operations means the same model asked twice, or a confidence number the model produced about itself. Neither is independent, and neither survives the question an auditor eventually asks: what would have had to be true for this to be stopped? If the answer is nothing, the control does not exist.

Both outcomes of the same gate, side by side

Decision certificateSealed

AGREEMENT — RELEASED

decision
claim.coverage.determination
predicate
computed agreement over the derived answer — not a learned score
model A
vendor-a / family-1 · version pinned and recorded
model B
vendor-b / family-2 · version pinned and recorded
heterogeneity
different vendor, different family, different weights
inputs
hashed at derivation time, sealed with the verdict
scope
tenant · owner · business unit
seal
sha256:4f9c1a7b…e920 (illustrative)
Re-verify: VALIDthe re-derivation reproduced the sealed verdict from the sealed inputs

[O] Illustrative composition, built from the components the product ships. No customer data appears anywhere on this site; the seal above is a placeholder, not a real digest. Cross-model contracts, verdicts and computed gates are observed at NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.ts and migration NCT/services/nexus-orchestrator/database/migrations/133_sentinel_core.sql NCT is a working tree of our core, not the primary checkout, which we state rather than hide.

The mechanism, in three lines

Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.

First

The models have to be different

Re-derivation by a second model from the same vendor and the same family correlates its errors with the first. Heterogeneity is the property being bought, and the versions of both are pinned into the record.

Then

The predicate is computed, not learned

Agreement is evaluated by a rule over the derived answers. Nothing about it is trained on your past outcomes, so it cannot quietly learn to approve what it used to stop.

Finally

Disagreement is a result

A failed predicate releases nothing and writes the failure to the thread with its machine code. You can count refusals, argue about them, and show a regulator that the control fired.

shipped(shipped)Deployed, with part of the element surface proven live rather than all of it — the count is below and we publish it as it moves.

35 of 102cross-model validation elements proven live so far[O]
2heterogeneous models must re-derive the answer before release[O]
0effects released on a failed predicate — the gate produces a refusal instead[O]
computedthe agreement predicate is a rule, not a trained score[O]

The honest limit