TRTrust + safety
The safety contract is the product.
These are implemented product controls and explicit limitations—not certification badges. Each control still depends on configuration, permissions, and verification of the exact workflow being used.
Approval is not execution
The product model keeps review, approval, merge, workflow dispatch, environment approval, and change management distinct. Current desktop builds keep local infrastructure apply disabled.
Typed workflow states
Core roles, workflow states, severities, and trigger kinds use closed-union types so unknown values are rejected by application validation.
Attributable evidence
Supported workflows preserve actor, action, rationale, timestamp, and outcome records. Hash utilities exist, but export and integrity coverage remain workflow-specific.
Human-confirmed AI output
AI output is guidance until a person confirms it. Uncertainty and unavailable providers must stay visible rather than falling back to simulated production success.
Secret-aware handling
Redaction utilities protect supported input and logging paths. This does not make every record safe to share; operators must still apply tenant and data-classification policy.
Bounded planning kernel
The orchestration kernel splits oversized resource groups and rejects steps outside configured limits. Enforcement against a released live cloud mutation path is not yet verified.
Control and assurance status
Product controls are separate from independent certifications and from each customer's own legal and compliance obligations.
Actor, decision, and outcome models exist in supported workflows; end-to-end export coverage varies.
Application utilities redact supported secret patterns before selected storage and notification paths.
Organization identifiers and access checks exist; every service and restore path still needs deployment-specific verification.
Requirements are tracked, but consistent customer-configurable retention and deletion are not verified across every store.
No independent certification or active audit is claimed.
Product controls can support a customer program; they do not make a customer compliant automatically.
Review the evidence model.
The documentation describes the audit records the application is designed to preserve, along with workflow-specific limitations.