Judgment where deterministic rules run out.
Not every request is a clean allow or clean block. Judgment review applies structured restrictive + counter pressure to the ambiguous middle, with a deterministic fallback that never leaves a verdict undecided.
Three roles, one loop
When the deterministic pipeline returns an ambiguous outcome — evidence is thin, the harm band is elevated, or the classification is contested — the judgment gate spins up three roles against the same evidence packet:
- Analyst — argues the strongest restrictive case for blocking or deferring the action, using policy and evidence.
- Challenger — argues the strongest counter case for proceeding, also grounded in policy and evidence.
- Classifier — resolves the two positions against the policy's decision rules and returns a structured verdict with a reason family.
Deterministic fallback is not optional
LLMs fail. Networks fail. Providers rate-limit. Every judgment call is wrapped by a deterministic fallback that reads the same evidence packet and returns a conservative verdict using the tenant's fallback rules. A verdict is always produced, always attributable, and never silently retried into a different answer.
Full transcript, hashed
Every judgment run — prompts, responses, timing, model identity, fallback triggers — is captured, hashed, and pinned to the evaluation record. Replay is not a best-effort feature; it is the primary artifact.
Model-agnostic by design
The judgment client is a single interface. Swap providers without changing gate logic, policy semantics, or the proof ledger schema. Pre-alpha ships on a default provider tuned for structured reasoning; enterprise deployments can pin their own.