Boundary-first information governance

Access control filters answers. Boundaries scope questions. Access control runs near the end of the query path. It gathers the data, then decides whether to return it. A boundary is part of the record. It’s a label fixed to every claim and copied into everything derived from it, so the unsafe answer is never assembled. This note describes how Syderial puts governance in the record through information flow control.

01 · A label on every claim

A boundary is a label on the claim

Every claim and every request in Syderial has a label with five axes: boundary, sensitivity, compartments, integrity and purpose. Each tenant sets up its boundary forests and sensitivity ladders from a template. A sensitivity ladder is ordered, and the order decides what happens when claims combine. A derived claim takes the strictest label of its inputs, and no operation lowers a label.

02 · A clearance on every reader

A reader sees a claim only when clearance dominates its label on every axis

A reader, whether a person or an agent, has a clearance on the same axes. The reader sees a claim only when that clearance dominates the claim’s label on every axis at once. A higher sensitivity rank doesn’t help if the compartment is wrong. A request can narrow the clearance it runs under, for a purpose. It can never widen it.

Two more rules close paths that a single check would miss. Taint follows lineage, so anything derived from untrusted input stays marked however many steps later. And a session that has read both private data and untrusted input can’t send anything out. Declassification takes two people, and Chinese walls close compartments that conflict.

03 · The label travels

An answer takes the labels of the claims it came from

The label is part of the claim, so every view computed from the claim gets it. A graph node derived from a restricted claim is restricted. A retrieved passage, a summary and an answer each take the strictest label of their inputs. No later step reattaches the label, because no step ever removes it.

Retrieval applies the same labels before ranking. A request names the clearance of the reader it serves, and Syderial never gathers claims outside that clearance, so they never compete for a rank. A claim the reader may not see can’t appear in the reader’s answer by any path.

04 · Why late filtering is unsafe

To filter an answer, you have to assemble it

A late filter retrieves a result, ranks it and keeps it next to everything else before it decides whether to return it. By then the unsafe assembly already exists in memory, in a prompt or in a log. One missed check, one new code path or one prompt that quotes its context crosses the boundary. Information flow control removes the unsafe intermediate state.

Context without boundaries becomes contamination. Syderial separates context before the model reasons over it.

05 · The same rule for actions

Policy is information flow control applied to actions

Logs say what an agent did. An operator needs to know what the agent was allowed to do, before it did it. Syderial checks every tool call against its reach ceiling, then allows it, sends it for approval or denies it before anything runs, under the same dominance rule that governs a read. Crossing a boundary on purpose is an explicit, signed act with its own entry in the journal, so the record shows what crossed, when, and under whose authority.

← All researchHow it works →