the sovereign data vault · 2026-09-11
Even the strongest models do not reliably follow their own skills and memory files, and they will tell you so. Trust has to live in the process around the model, not in a promise the model makes to itself.
Anyone who has built with AI assistants for long enough has had this exchange. The assistant makes a mistake you have told it never to make again. You point it out. It apologises and says it will write the rule down so it does not happen again. Five minutes later it happens again, and when you look, the rule was already in its skills file, or its memory file, or both. Sometimes twice. Ask the assistant why, and the honest ones will tell you: an instruction file is context, not a constraint, and even the most capable models do not yet reliably act on it.
We have spent more than two years at IAXOV developing with, for, and to large language models, and that exchange is the single most repeated moment in the work. It is not a defect in any one vendor's product. It is what a language model is. A rule in a file competes with everything else in the window for the model's attention, and it loses some of the time. In a demonstration, "some of the time" is a rounding error. In a regulated process, it is the whole problem.
Mike Boonstra, IAXOV's Chief Revenue Officer, put the distinction in one line recently: "AI that works gets a demo. AI you can trust gets deployed." A demo needs the model to do the right thing once, in front of you. A deployment needs the wrong thing to be impossible, or caught, refused and recorded, every time, when nobody is watching. The first is a property of the model. The second is a property of the process around the model, and no amount of instruction text converts one into the other.
Governance you can trust is structural, not textual. SentryVault does not ask a model to remember its rules. The workflow cannot write a conclusion because the field that would hold one is absent from the capability's allow-list. A redaction step that cannot reach its service stops the workflow rather than forwarding raw text on the assumption that it was clean. Every data operation runs as the caller, so the data plane's own permissions decide what comes back, not a prompt. The human gate's authority is written by the engine itself, never read from a document that could claim it. Not one of these controls depends on anything remembering anything.
Tailorable. Governance in SentryVault is configuration, not code. Roles are declared. The capabilities a workflow may invoke are a catalogue of named, scoped operations, and that catalogue is the entire outward data surface. The whole arrangement arrives as a signed configuration bundle, so changing what a vault is, or what a process may touch, is a reviewed change to data rather than a redeployment of software. Your privacy and legal teams can read the catalogue in an afternoon and know exactly what the system can reach.
Auditable. Every state-changing action lands on an append-only ledger indexed by actor, time, event and target, with before and after states. The controls themselves are tested to refuse: the gate suite exists to produce refusals, and it refuses to report a gate that asserted nothing. A permission clause is not a control until something has been refused by it, and every control in the substrate carries a recorded red result as well as a green one.
Self-teaching, in a precise sense. This is not model training. No data flows back into a model and nothing inside a model changes. The governance layer SentryVault runs on measures its own judgements against outcomes that were later confirmed, re-fits the weights it uses to score evidence with optimisation mathematics, and detects drift statistically before it becomes a pattern. Every adjustment is a recorded, reversible event on the same ledger. It learns the way a calibrated instrument learns: by being checked against a reference and adjusted, in the open, where an auditor can see it.
Then the rest of the business. SentryVault protects the data and the processes that touch it. Legion by IAXOV extends the same governance to AI in any role: work is routed to deterministic steps wherever a deterministic step exists, and a model is invoked only where judgement is needed, inside the same gates, allow-lists and ledger. PanaceaUX is the experience layer on top: policy-driven, multi-device interfaces synthesised under the same governance, so the people and systems that reach the work do so through governed contracts rather than through the data. Together they make a business AI-supported in a way its owners, its clients, and its security, legal and privacy teams can finally trust.
The note to self was never going to hold. It asked a probabilistic system to behave like a constraint, and it is not one. Put the constraint where it belongs, in the process the model runs inside, and the model can be as capable and as fallible as it is. That is what gets deployed.