Agentic AI you can put in front of counsel.
Brandeis runs a staff of AI agents on public records — the one domain where “the model decided” is never an acceptable answer. So the guardrails are not policy: they are invariants enforced in code and proven by tests.
Agents propose. A named human disposes.
Every AI output is a reviewable draft — an accept, edit, or dismiss card. Nothing legally significant leaves the building without a named person deciding it should.
Action tiers, enforced in code
Every agent action has a tier. Legally significant, requester-facing actions are always-human by construction — no configuration, no flag, no approval chain can make them autonomous. A forbidden action stays forbidden even if a human approves it.
Approvals are per step, never per run
When an agent's plan reaches a checkpoint, a named staffer approves that step — not the run. The next sensitive step waits for its own approval. Agents park; humans resume them.
Every agent runs on a budget
Action budgets cap what a run can do before it must stop and report. A runaway agent is a bounded, logged, resumable event — not an incident.
Provenance on every AI output
Each agent action records the model, the prompt version, and the outcome in the audit log. When counsel asks "why did the AI suggest this," the answer is a log row, not a shrug.
Classification only ratchets safely
An AI agent may propose that a record is public; only a named human can make it so. Nothing internal becomes public by automation — in either the agents' hands or a sync job's.
No AI required at all
The AI layer is opt-in behind an adapter, like every external service. A deployment with no AI key still runs the full records desk — the agents are leverage, never a dependency.
Built to be audited.
Append-only audit log
Request and admin events are insert-only — there is no update or delete path in the codebase. Human and agent actions land in the same permanent record.
True redaction
Finalizing a redaction burns it into fresh bytes — never an overlay a reader can lift. A residual leak check verifies before release.
Releases anyone can verify
Every release is fingerprinted at approval (SHA-256). A court or newsroom verifies a file in the browser; it never uploads.
One platform, every agency its own house.
Tenant isolation, proven by tests
Every tenant table is scoped in the data layer and every repository method passes a conformance suite that tries to cross the line. One agency can never see another's records.
Public means public, everywhere
Requester-facing surfaces — portal, answer box, MCP endpoint for AI agents — are hard-scoped to already-public records in the query layer. Enabling the machine door never widens what anyone can see.
Self-contained by design
Embedded database, local file storage, zero required external services. Self-host it and your records never leave your infrastructure.
Even this marketing site follows the posture: measurement is first-party and anonymous by construction — no third-party trackers, no visitor ids, no IP addresses stored, and Do Not Track honored. What we don't collect can't be breached.
Bring the hard ones.
Security questions, disclosure reports, or a walkthrough of the guardrails on the live product: [email protected].
Or see the audit trail yourself on the live demo.