input → normalise → PII redaction → injection and jailbreak classifiers
→ policy check (role × purpose × data class)
→ retrieval with row-level security
→ model (on-premises)
→ output checks: grounding · PII · secrets · toxicity
→ tool calls: allow-list × autonomy level × approval
→ hash-chained audit log