For the Chief Risk Officer
One model produced the answer, and nothing else checked it before it took effect.
A second opinion in most AI operations means the same model asked twice, or a confidence number the model produced about itself. Neither is independent, and neither survives the question an auditor eventually asks: what would have had to be true for this to be stopped? If the answer is nothing, the control does not exist.
Both outcomes of the same gate, side by side
AGREEMENT — RELEASED
- decision
- claim.coverage.determination
- predicate
- computed agreement over the derived answer — not a learned score
- model A
- vendor-a / family-1 · version pinned and recorded
- model B
- vendor-b / family-2 · version pinned and recorded
- heterogeneity
- different vendor, different family, different weights
- inputs
- hashed at derivation time, sealed with the verdict
- scope
- tenant · owner · business unit
- seal
- sha256:4f9c1a7b…e920 (illustrative)
REFUSED
GATE_DISAGREEMENT
The two models did not agree, so no effect was released — no payment, no decline, no letter, no downstream job.
The agreement predicate is computed over the derived answers, not learned from past outcomes, so it cannot be tuned into passing. A disagreement is a result, and it is written to the record with the same weight as a release. This is the behaviour that makes the gate a control rather than a label — and it is designed at tier five, which does not yet run in production.
[O] Illustrative composition, built from the components the product ships. No customer data appears anywhere on this site; the seal above is a placeholder, not a real digest. Cross-model contracts, verdicts and computed gates are observed at NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.ts and migration NCT/services/nexus-orchestrator/database/migrations/133_sentinel_core.sql — NCT is a working tree of our core, not the primary checkout, which we state rather than hide.
The mechanism, in three lines
Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.
First
The models have to be different
Re-derivation by a second model from the same vendor and the same family correlates its errors with the first. Heterogeneity is the property being bought, and the versions of both are pinned into the record.
Then
The predicate is computed, not learned
Agreement is evaluated by a rule over the derived answers. Nothing about it is trained on your past outcomes, so it cannot quietly learn to approve what it used to stop.
Finally
Disagreement is a result
A failed predicate releases nothing and writes the failure to the thread with its machine code. You can count refusals, argue about them, and show a regulator that the control fired.
shipped(shipped)Deployed, with part of the element surface proven live rather than all of it — the count is below and we publish it as it moves.
NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.ts and migration 133_sentinel_core.sql. None of them is a customer measurement; we have no customers yet.The honest limit
EVERYTHING ON THIS PAGE IS SHIPPED
Every capability described above resolves to a repository path we publish. Where a pillar has an unbuilt part, that part is named on its own page — see thetrust centre for the full register.