We Sit in Front of the Model You Already Have

Keep the model. Gate the write. A GC can screenshot this page.

Only Institute · PrimeSwarm
11 September 2026

Companion papers: The HITL Contract · The Industry Wants a Write-Path Gate · Two Keys, Not a Cliché

Quote in the room: /quote · Spine: What is on offer

---

House line. Statistical AI guesses. We sit in front of the write and leave a receipt.

You already have a model. You rent it (ChatGPT Enterprise, Claude, Copilot, Azure OpenAI, Bedrock). You bought seats. You run weights on a GPU in the cupboard (vLLM, Ollama, an on-prem Llama, DeepSeek, Grok behind your own proxy). That bill stays yours. We do not take it. We do not replace the model. We sit in front of the hop where that model is allowed to send, file, or write a record.

This is not a chatbot. It is not a better GPT. It is not a consciousness score. OpenAI, Anthropic, Microsoft, Perplexity, Cohere, DeepSeek, and xAI are cognitive nodes on your map — not our customers, and not our competitors for this job.

---

1. Three ways you already have a model

How you have it	Typical names	What we do	What we do not do
Rent	ChatGPT Enterprise, Claude, Copilot, Azure OpenAI, Bedrock, a vendor “assistant” on the EHR or DMS	Sit in front of the tool call. Capability before the write. YELLOW until a named human binds send or file.	Cancel the subscription. Resell tokens. Wrap their safety filter and call it ours.
Bought	Seats, committed use, a fine-tune you paid to host	Same gate. Same catalog. Same receipt. Their GREEN is not our ADMITTED.	Train on your records. Put tokens on our invoice.
Localhost / on-prem	vLLM, Ollama, a weights file, an air-gapped Llama, DeepSeek or Grok behind your proxy	Same hop. Estate if the box must stay in your VPC. Fail closed if the catalog is missing.	Pretend localhost is safe because it did not leave the building. An ungated local write is still a write.

If the log only says the service account did it, the receipt is incomplete. If send-as is on the mailbox and we are not in front, that is not “draft-only.”

---

2. The hop

Human  →  IdP you already have (Entra / Okta / Ory)
       →  PrimeSwarm (catalog, capability, HITL)
       →  TPNN strip (model sees L0; L2 stays with the human)
       →  The model you already rent, bought, or run locally
       →  Tool / send / file  only if GREEN, or YELLOW bound by a named human
       →  Receipt (agent that proposed, human who bound, proof id)

Missing agent_id is RED before the tool runs. Undeclared write is RED. An agent JWT cannot bind a send or a file. Replay of a spent proof is RED. If the HITL plane cannot persist the queue, the propose is RED. Reads with a declared capability may GREEN. Send and file may not.

Machine copy of that contract: GET /v1/hitl/contract. Human copy: The HITL Contract.

Keep LangGraph, Copilot, Bedrock, Foundry, OpenPages. We speak MCP and A2A. Ungated A2A is TCP without TLS. We do not ask you to rip out the runtime you already hired developers to learn.

---

3. What we are not

They already hired	We are not that job
A model (OpenAI, Anthropic, Microsoft, Perplexity, Cohere, DeepSeek, Grok)	We do not sell weights. Tokens are never on our line table.
A programme of record (IBM watsonx.governance, Credo, OpenPages)	We do not replace the inventory. Their GREEN is still a score.
An ontology (Palantir AIP)	We do not rip out Foundry. A foreign GREEN is not our ADMITTED.
An IdP (Ory, Okta, Entra)	We sit in front of it. We do not replace it.
A prompt filter (NeMo, Bedrock Guardrails, Azure Content Safety)	Keep it. A classifier on the string is not a capability on the write.

Do not pick a fight with the labs. A BD meeting at the model vendor is a feature request they will copy. Getting “in front of OpenAI” means Helm on your hop to their API.

---

4. Act is not believe

Permission to act: may this agent call this tool, on this resource, now? GREEN / YELLOW / RED plus a 64-character proof id.

Permission to believe: may we keep this fact? Admit / quarantine / reject. Same identity, different title — quarantine. Last-write-wins is how a patient’s name, a company’s registered title, or opposing counsel gets overwritten by a guess.

A Copilot summary is not a filing. A Claude draft is not a send. A localhost Llama that wrote the record is not safer than ChatGPT that wrote the record. The building did not bind it. A human did — or nobody did.

---

5. How this enters the building

1. Node Exposure Assessment. Name every cognitive, record, identity, external, execution, memory, and human node that already (or intends to) touch AI. That picture is usually the close.
2. SKU. Guard — hosted control plane, your tokens. Estate — the box stays in your VPC; a human binds the SOW. Federation — two named entities in the room; their GREEN is not our ADMITTED. Marketplace $49 is not this product.
3. Instrument. Catalog the agents. Put PrimeSwarm in front of send, file, and record writes. Leave the model where it is.
4. Prove. A YELLOW resume with two names on the receipt. Not a dashboard. Not “the model is aligned.”

We do not print SOC 2, ISO 42001, FedRAMP, FDA, or HIPAA as product claims. Mapped today; certified when an auditor signs. Deployment claims stay in a signed SOW.

CTA. You already have a model on a record. We will sit in front of the write. Open the list quote in the room. A person sends the link. An agent does not email you.