The data border
Deny by default, and name the field that refused.
Most systems treat the network as open and add exceptions. This one treats it as closed and adds permissions, which means the failure mode of a forgotten declaration is that nothing leaves — not that everything does. Every outbound attempt produces one decision per source, and every refusal names the field responsible, so "denied" is never a mood.
Private
No request leaves the device. The external lane is not offered, not merely refused.
Sovereign
Only destinations on the approved list may be reached, and only sources the catalog permits may be sent.
Connected
Destinations are open. Per-source permission is still enforced — connected is not consent.
Connected is not consent. In connected mode the destination is open, and the per-source permission is still enforced. A source classified RESTRICTED does not leave in any mode, for any purpose, and there is no override flag — the check is on the classification itself, not on a setting beside it.
Reading is not training
may_leave_device and may_train_model are separate fields, checked separately. Of 20 sources, 0 may leave and 0 may be trained on. The engine will not infer one permission from the other in either direction.
Silence is refusal
A source whose may_leave_device is simply absent is refused with the reason "an unanswered permission is a refusal, not a default", which is deliberately different from the reason given when somebody wrote false. One is a gap in the catalog; the other is a decision. They should not read the same.
A boundary is only real if you can watch it refuse something.
Run it
The border, deciding.
This runs egressDecision() from /engine/sovereign.mjs against the real catalog. No request is made to anywhere — the decision is the product.
Four decisions, computed at build time
Private mode — a research question about every source
DENIED PRIVATE 0 allowed · 20 denied
Destination: Private mode. The device makes no outbound request at all, so the destination was never resolved.
Mode rule: No request leaves the device. The external lane is not offered, not merely refused.
00_START_HERE.txt— denied: mode=PRIVATE — nothing leaves the device; destination refused; may_leave_device=false — the catalog forbids itDiscord_Architecture.csv— denied: mode=PRIVATE — nothing leaves the device; destination refused; may_leave_device=false — the catalog forbids itEditorial_Taxonomy.csv— denied: mode=PRIVATE — nothing leaves the device; destination refused; may_leave_device=false — the catalog forbids itPricing_Tiers.csv— denied: mode=PRIVATE — nothing leaves the device; destination refused; may_leave_device=false — the catalog forbids it- … and 16 more, decided the same way
Sovereign mode — an approved destination, every source
DENIED SOVEREIGN 0 allowed · 20 denied
Destination: integrate.api.nvidia.com is on the approved list.
Mode rule: Only destinations on the approved list may be reached, and only sources the catalog permits may be sent.
00_START_HERE.txt— denied: may_leave_device=false — the catalog forbids itDiscord_Architecture.csv— denied: may_leave_device=false — the catalog forbids itEditorial_Taxonomy.csv— denied: may_leave_device=false — the catalog forbids itPricing_Tiers.csv— denied: may_leave_device=false — the catalog forbids it- … and 16 more, decided the same way
Sovereign mode — a destination nobody approved
DENIED SOVEREIGN 0 allowed · 20 denied
Destination: api.openai.com is not on the approved list. Sovereign mode denies by default; an unlisted destination is denied, not queued.
Mode rule: Only destinations on the approved list may be reached, and only sources the catalog permits may be sent.
00_START_HERE.txt— denied: destination refused; may_leave_device=false — the catalog forbids itDiscord_Architecture.csv— denied: destination refused; may_leave_device=false — the catalog forbids itEditorial_Taxonomy.csv— denied: destination refused; may_leave_device=false — the catalog forbids itPricing_Tiers.csv— denied: destination refused; may_leave_device=false — the catalog forbids it- … and 16 more, decided the same way
Connected mode — the restricted source only
DENIED CONNECTED 0 allowed · 1 denied
Destination: Connected mode. api.openai.com is reachable.
Mode rule: Destinations are open. Per-source permission is still enforced — connected is not consent.
Maricopa County Election Rollout — Cost to Deliver and What You Can Charge.md— denied: classification=RESTRICTED — never leaves, in any mode, for any purpose; may_leave_device=false — the catalog forbids it
Evidence mode
An answer that cannot name a source is refused, not softened.
There is no confidence score here and no hedged paragraph. evidenceFor() takes an answer, looks at what it cites, and if the list is empty it returns a refusal with the reason "no local source supported this". A system that degrades gracefully into an unsourced guess is exactly the failure this whole architecture is built to prevent, and graceful is the wrong shape for it.
With sources
Each row: the file, its SHA-256, the locator inside it, and the authority tier that source holds. The reader can open the file and check.
Without
REFUSED Nothing is returned. Not a shorter answer, not a caveated one.