The model is not the boundary.
The rules that decide what may execute are ordinary code, not text in a prompt. Whatever the AI proposes, code classifies before anything runs — so talking the model round does not get you past them.
01The short answer
Four questions, before anything technical.
Every board that has looked at agentic AI has asked us the same four things. Here are the answers in one line each. Open any of them if you want the detail.
Built for the AI Act, in code.
Article 5 and Article 50 obligations are enforced structurally, not by prompt. Every action lands in a tamper-evident record, so audit becomes a query rather than an archaeology project.
It works the hours nobody can staff.
It runs continuously, wakes on events rather than requests, and holds context across every shift handover. Every model call is metered by role and by event.
The value compounds. The cost doesn't.
One platform holds many expert roles. The first is a project; the eleventh is a configuration file. Meanwhile the memory keeps getting more valuable.
02Why most AI never pays back
It starts from zero every single time.
A conversation ends and the context is gone — the reasoning, the constraint someone raised, the reason a workaround exists. You pay again next week for knowledge you already bought. Infrastructure that remembers does the opposite.
03Where the return comes from
Six axes. No invented percentages.
We will not show you a made-up efficiency figure from someone else's deployment. Here is the honest version: the specific mechanisms that produce return, so you can put your own numbers against the ones that apply to you.
Knowledge that stops walking out
The reasoning behind decisions is captured as it happens and cited back years later. Resignations and reorganisations stop resetting the institution.
Coverage without headcount
Continuous watching of things no rota can cover at 3am. It wakes on the event rather than waiting to be asked the next morning.
Audit cost that stops recurring
The evidence pack assembles itself continuously. You stop paying people to reconstruct last year from log files every time someone asks.
Incidents that end sooner
Context around an anomaly is assembled automatically, and recurring patterns are recognised against every previous instance — including the ones nobody remembers.
Spend you can actually see
Every model call is metered by role and by event against a declared daily budget — soft-warning by default, a hard ceiling when you turn enforcement on. A budget line you control rather than a bill you receive.
A second role costs almost nothing
The platform is the investment. Each additional expert role is a configuration file on the same engine — so the business case improves with every one you add.
The one number we will stand behind: in a live hostile exercise against our running production system, 56 of 56 adversarial attempts failed to get a destructive action executed. See the full result, including the one that first got through ↓
04Why it is safe
Everyone else puts the guard inside the thing being guarded.
If your safety rules are written into the prompt, then anyone who can talk the model round has talked the guard round too. We moved the guard outside. The AI proposes; code decides.
The five controls that never consult a modelfor technical readers
01 · Blast radius
Fails closed by construction
Every proposed command is classified by a deterministic rule engine into a scope, a reversibility and an impact. If no rule matches, the default is not "probably fine" — it is unknown scope, irreversible, high impact, and unknown is the one verdict that can never auto-execute.
02 · Four-tier gate
Nothing executes unclassified
Tier 0 read-only runs automatically. Tier 1 reversible runs automatically. Tier 2 semi-reversible announces itself and holds a real 60-second cancellation window. Tier 3 irreversible requires a single-use, command-specific operator token that cannot be replayed.
03 · Constitutional floor
Configuration can only tighten it
A small set of constitutional rules sits underneath every persona. A persona's configuration can add restrictions; it can never weaken a constitutional decision. Operators who enable keyed integrity checking on the rule set get a further property: a failed check drops the daemon into lockdown, where every action becomes approval-gated.
04 · Domain firewall
Two layers, outside the model
A pre-call gate rejects requests outside the persona's declared domain before the persona's model ever sees them; a post-response gate scans the draft reply before it reaches any channel. An absent or mistyped setting resolves to closed. Personas bound to live infrastructure cannot opt out at all.
05 · Severance
Isolation at the database layer
Per-persona row-level security in PostgreSQL — forced, not merely enabled — with the daemon installed to connect as a role that explicitly cannot bypass it. Memory, documents, conversations and knowledge are scoped by the database itself, not by a filter in application code that someone might forget to apply.
Evidence
A chain with no side door
Actions are written to a keyed hash chain that is append-only at the database layer and tamper-evident on disk: verification walks the whole file and tells deletion apart from in-place editing. The daemon re-verifies on every boot and refuses to overwrite its anchors when they disagree, so pre-tamper evidence survives.
We are deliberately precise about this: the model layer is not a security barrier and we do not present it as one. What we claim is defence in depth with a deterministic floor — and we test that floor adversarially against the running system rather than against a fixture.
What happens to an inbound event
A message, a syslog alert, a webhook, a scheduled tick or a spoken sentence is routed to the persona that declared an interest in that source, then walks an eighteen-stage pipeline. High-stakes events run twice: a first pass drafts an answer against full persistent memory, then a second pass re-grounds that draft against evidence and regenerates any proposed action when ground truth turns out to differ. Between those stages sit the deterministic gates — the domain firewall, the policy engine, the blast-radius classifier and the database's own row-level security. None of those decisions are delegated to the model.
05What it actually does
One engine. Eleven expert roles. Sealed from each other.
Each role — a platform engineer, a regulatory specialist, a security analyst — is defined by a configuration file, not by a separate product. They share one engine and one safety floor, and they cannot see each other's data.
It listens
Wakes on events
Chat, mail, voice, calendar, alerts above a severity, repository webhooks, scheduled ticks. Each role binds only the sources its job needs.
It remembers
Captures decisions silently
Decisions made in ordinary conversation are recorded with citation IDs and returned when someone later asks why. No one has to remember to write it down.
It acts
Within a declared boundary
Each role has an explicit list of what it may touch and where it may act. Everything not listed is denied — the default is no, not yes.
All eleven roles, and how a new one is createdfor technical readers
A persona is not a system prompt. It is a complete operational contract: which channels it listens on, which tools it may call, which domains it may reason about, which outbound actions it may take, how much it may spend per day, and which slice of the database it can see. Each gets its own port, memory namespace and row-level-security scope.
Platform Engineer
Bare-metal infrastructure via GitOps — Nomad, k3s, Kubernetes, ArgoCD, Vault, Prometheus, Wazuh. Detects drift between live cluster state and git HEAD and files a reconcile issue with a checklist. Reviews pull requests on webhook.
Security Analyst
Threat detection, vulnerability management and SIEM analysis across Wazuh, Shodan, Nmap, Snyk and VirusTotal. Listens to syslog at WARNING and above.
Compliance Officer
Regulatory monitoring, policy-drift detection and compliance verification, working from read-only inspection tools against the platform's own evidence ledger.
Healthcare Regulatory Expert
EU health-data regulation: GDPR, the AI Act, MDR/IVDR, EHDS, NIS2 and the Data, Data Governance and Cyber Resilience Acts. Ingests EU primary law live from the CELLAR API and answers with clause-level citations.
FHIR R4B Expert
The complete HL7 FHIR R4B normative specification — plus EU implementation guides, IHE profiles, EU terminology standards and the open-source tooling ecosystem. Answers R4B-first and flags every R4 and R5 delta rather than blurring them.
Healthcare Data Engineer
Clinical data pipeline orchestration across Dagster, Aidbox FHIR, MSSQL and HL7v2, with data-quality expectations. Wakes on pipeline errors rather than waiting to be asked.
Data Analyst
Data pipelines and business intelligence — Dagster, PostgreSQL, DuckDB, Grafana, BigQuery, Google Sheets and dbt. Turns warehouse questions into validated queries rather than plausible-looking numbers.
Project Coordinator
The corporate knowledge keeper. Tracks every active project independently and captures institutional decisions across all teams. Posts risks to the append-only cross-persona whiteboard — the one shared surface, where nothing can be removed.
RSYD DAAI
A domain-total expert on one organisation's BI and data-warehouse estate: Dagster orchestration, Oracle and MSSQL extraction, staging conventions and Kimball dimensional modelling. Proof that a role can be scoped to a single codebase.
Climate & Biodiversity Truth Base
A curated source of truth for NGOs. Compounds observational data, IPCC/IPBES/UNEP/WMO assessments and official statistics, then answers with source-level citations and an explicit truth score — a method the role is instructed to hold itself to, and to show its working for.
Personal Assistant
Calendar, communications and meeting management, with a voice gateway available for hands-free use. No send tool in its allowlist — it reads, schedules and drafts, with bulk send and deletion explicitly denied, and any outbound mail is a Tier 2 action carrying a 60-second cancellation window.
Five more, one copy command away
These ship as documented starting points rather than running roles, and are deliberately invisible to the engine until an operator activates one — so nothing starts that nobody asked for.
template
Finance Analyst
Budget monitoring, AP/AR tracking, spend analytics. Read-mostly: drafts, never authorises payment.
template
Legal / Contracts
Contract review support, redline drafting, clause citation, NDA and IP tracking. Never gives legal advice.
template
Support Agent
Ticket triage, canned-response drafting, SLA tracking and escalation routing.
template
Sales / Pipeline
CRM hygiene, lead follow-up and quote drafting. Drafts only — never sends binding terms.
template
Clinical Operations
Staff scheduling, room and equipment utilisation, supply chain, capacity planning. Explicitly not a patient-data role.
Creating a new role
The engine has no hardcoded persona list. It discovers roles by reading a directory at startup, so a new expert role is authored rather than programmed — no fork, no retraining, no model fine-tune, no change to the reasoning platform. Standing it up as its own deployed container is one further step: regenerate compose and add the container to the deployment allowlist. We would rather describe that step than pretend it is not there.
Copy a template
Start from the shipped persona template or the closest existing role.
Give it an identity
Name, description and a memory namespace unique across the fleet. File name and declared name must agree; the platform refuses to load a mismatch rather than guessing.
Claim ports and channels
An API port for its console and its own channel credentials. A collision on the same named port field between two deployed roles is a hard validation error.
Write the two overlays
One says who the role is; the other says how it works. The only part of the process that is genuinely authorship — and where domain expertise gets encoded.
Draw the boundaries
Declare allowed domains, tool allowlist, outbound channels and daily budget. Anything left out is denied, not permitted.
Regenerate and start
Run the compose generator and routing validator, then bring it up. It is provisioned with its own memory namespace and row-level-security scope, under the same platform guarantees as every other role.
personas/grid_operations.yaml — illustrative
# ── identity ─────────────────────────────
name: grid_operations
display_name: Grid Operations Analyst
description: SCADA/EMS telemetry review, outage
correlation and switching-plan verification.
memory_namespace: grid_operations
# ── where it listens ─────────────────────
input_sources:
- source: syslog
filter: severity >= WARNING
# ── what it may touch ────────────────────
tool_allowlist_enforced: true
tool_allowlist:
- historian_query # read-only
- outage_record_reader
- switching_plan_validator
# ── what it may say ──────────────────────
domain_gate:
enabled: true
fail_closed: true
allowed_domains:
- grid_operations
- outage_management
- scada_telemetry
forbidden_topics:
- "direct control action"
- "breaker operation"
# ── what it may do, and for how much ─────
outbound: [ jira ] # no chat, no mail
daily_budget_usd: 4.0
network:
api_port: 8913
runtime:
deploy: true # emit a container
Note what is absent. There is no permission this file can grant itself.
Omitting outbound means the role cannot message anyone;
omitting a tool means the tool does not exist for it; and nothing written here can
lower the safety floor underneath.
06Critical infrastructure
For the places where "the model hallucinated" is not an acceptable incident report.
Operators of critical systems have been slow to adopt AI, and they have been right to be. What was on offer forgot everything, could not explain itself, acted with the same confidence whether right or catastrophically wrong, and wanted your operational data in somebody else's datacentre. We inverted all four.
01
It survives the handover
Control rooms lose context at every shift boundary. A daemon running for eighteen months remembers last winter's workaround, who decided it and why.
02
It cannot exceed its tier
Advisory roles get read-only tools and no outbound channel. Anything irreversible stops at a human-held key. The boundary is code, so it holds under manipulation.
03
It runs where your data is
On-premises daemon, your database, your network. Where inference must stay inside the estate, a residency check refuses to dispatch anything but a local model.
04
It produces a defensible record
Tamper-evident audit chain, per-turn traces, captured decisions and automatic postmortem assembly. Regulators and insurers ask for this and rarely get it.
Where it lands
Each of these is a configuration, not a separate product.
Hospitals & health systems
Three of the eleven shipped roles were built for this — an EU regulatory expert answering from primary law, a FHIR specialist, and a clinical data engineer that wakes on pipeline failure.
Energy, water & grid
Advisory roles that read telemetry and check switching plans against procedure, while anything that would change plant state stops dead at an operator key.
Transport & logistics
Continuous watching of signal no rota can absorb, with degradation surfaced as a pattern across every prior instance rather than as one more alert.
Public sector & registries
Sovereignty as the entry requirement: your hardware, your database, per-role isolation enforced by PostgreSQL rather than by policy.
Financial market infrastructure
Roles that draft and never authorise — enforced by the platform, not by convention — with metered spend and a chain that proves what was done.
Your estate
If the cost of a confident wrong answer is measured in something other than money, the architecture was built for you. Let's talk ↓
The detail, sector by sector — and what we are not claimingfor technical and compliance readers
Hospitals & health systems
Nearest to our shipped work
- An integration engineer asks whether a proposed resource profile is conformant — and gets the specific clause, not a plausible paraphrase.
- A privacy officer asks what changed in a regulation since the last assessment, and the role tracks the superseding version rather than answering from a stale snapshot.
- A nightly pipeline drops rows; context is assembled automatically and filed before the morning stand-up asks.
- Patient-adjacent data never leaves the estate, and the clinical-operations role is scoped to logistics with no route to patient records at all.
Energy, water & grid
Advisory tier, hard-stopped
The instinct in utilities is that AI must never touch operations. The four-tier gate lets you say that precisely rather than categorically.
- Overnight alarm floods correlated against two years of similar events — including ones whose root cause was found by an engineer who has since left.
- A proposed switching sequence checked against written procedure, with the reasoning and the source clause both recorded.
- An unrecognised command is classified irreversible and high-impact by default, so novelty is treated as danger rather than as permission.
- Estates that cannot let data leave run the local-inference configuration, where reaching a hosted model is refused at dispatch rather than discouraged in policy.
Transport & logistics
Continuous, event-driven
- Recurring degradation surfaced as a pattern with citations to every prior instance.
- Incident reconstruction starts from an assembled timeline rather than from thirty minutes of log archaeology.
- Coordination roles draft the operational notice; a human still sends it, because outbound is allowlisted per role.
Public sector & national registries
Sovereignty is the requirement
Public bodies are frequently unable to use hosted AI at all — not for lack of appetite but because of residency and procurement constraints. One shipped role is scoped entirely to a single regional health authority's data-warehouse estate.
- Institutional memory outlives both staff turnover and supplier turnover, because it lives in your database.
- Departmental roles cannot read one another's data — a database policy, not a filter someone might forget.
- AI Act transparency handled structurally rather than by instruction: the disclosure is emitted in code at the mail, chat and issue-tracker egress points, so the model cannot paraphrase it away.
- Actions land in a hash chain, and a signed evidence pack lets a reviewer re-run verification from a bundle rather than from access to your live system.
Financial market infrastructure
Read-mostly by construction
The operational-resilience question in finance is rarely "can it answer" and almost always "can you prove what it did, and prove it could not have done more".
- Reconciliation and reporting roles draft; they never authorise. A configuration the platform enforces, not a convention staff are asked to follow.
- Per-call cost metering and hard daily caps make spend an operational control rather than a monthly surprise.
- Control changes captured as decisions with citation IDs at the moment they are made, in the conversation where they were made.
What we are not claiming, plainly. NOETICS holds no certifications: Phoenix Daemon is not SOC 2 or ISO 27001 certified, and our EU AI Act documentation is a provider self-assessment with per-control source citations — not a conformity assessment, and not legal advice. Where a role reasons about NIS2, MDR, IVDR or EHDS it is citing a curated corpus for your specialists to check, never asserting that the platform complies with them. The security review of our distributable was conducted from an external posture but not by a named assurance firm, and it did not reach the compiled binary. Our single-estate role reasons over a local snapshot of one authority's codebase — we do not operate inside their systems. Several capabilities described elsewhere in our documentation sit behind default-off flags, and we label them that way. Every one of these is easier to say here than to have found in due diligence.
07EU AI Act
Article 50 became binding on 2 August 2026. We shipped for it in July.
Transparency obligations now apply to every in-scope system already on the market, with penalties up to €15 million or 3% of worldwide turnover. Most vendors meet them with a line in a system prompt. A model can paraphrase a system prompt away.
Ours are emitted in code at the point content leaves the system, where the model has no say in the matter — and a structural test sweeps every outbound adapter to catch a new channel that forgets.
ObligationWhat Phoenix Daemon doesStatus
Article 5Prohibited practices
A deterministic prime-directive layer at three independent chokepoints. Its verdict type can only pass, escalate or block — it structurally cannot lower an existing safety decision, and there is no flag that turns it off.
Enforced in code
Article 50(1)Interactive-AI disclosure
Fixed literals emitted at each channel egress seam — spoken before the voice stream opens, announced on joining a meeting, prefixed in chat, footed in email. Not an instruction to the model, so it cannot be paraphrased away.
Enforced in code
Article 50(2)Machine-readable marking
Email carries RFC 3834
Auto-Submitted plus AI-generated headers and a visible label; text posted to chat and issue trackers carries an attribution suffix. Live synthetic audio is handled by a layered approach under the transitional period to December 2026.
Text & email in code
Article 12Automatic logging
A keyed hash chain, append-only at the database layer, with signed anti-truncation anchors, re-verification on every boot, and an evidence pack a reviewer can verify from a bundle.
Control shipped
Article 14Human oversight
The four-tier action gate: irreversible actions stop at a single-use, command-bound operator token; semi-reversible actions hold a real cancellation window; a kill switch pauses execution until a human clears it.
Control shipped
Article 10Data governance
Per-role isolation enforced by PostgreSQL row-level security, a PHI guard, secrets vault, transcript redaction and declared retention horizons.
Control shipped
Article 50(3) & (4)Emotion recognition · biometrics · deepfakes
The platform implements none of these. The one latent sentiment surface in the voice stack is locked non-editable in code, citing Article 5(1)(f) — an operator cannot switch it on from the console.
Not applicable, locked
Annex IIIStandalone high-risk
Deferred to December 2027 by the Digital Omnibus. We have not classified the platform as a high-risk system and we do not claim high-risk readiness. The Article 12 and 14 controls that regime will want are already shipping.
Not claimed yet
Roles, stated plainly. eHealthBrains is the provider of the platform and carries the provider obligations above. Where you deploy it, the Article 50(3) and (4) deployer duties are yours — and the controls here are built to make discharging them straightforward rather than to pretend they do not exist.
How the transparency layer is enforced — and the four things we do not claimfor compliance readers
Article 5 · the type guarantee
A downgrade cannot be written
The prohibited-practices layer returns a verdict that carries no tier field at all. Lowering an existing safety decision is therefore not a bug we test for and avoid — it is a value that cannot be constructed. The rules are compiled into the platform, deliberately not expressible in the signed configuration, and there is no flag, console toggle or persona setting that disables the layer.
Article 50 · the structural tripwire
New channels cannot quietly skip it
An automated structural test walks every outbound adapter module and every conversational channel adapter, and fails if one lacks a disclosure marker. It is a tripwire against the realistic failure — someone adds a channel in six months and forgets — rather than a one-time audit. It currently passes across every known egress module. In the interest of precision: that suite runs advisory in our pipeline today, so we describe it as a tripwire, not as a merge block.
Personas vs platform
Two different things called compliance
Our healthcare regulatory role reasons about the AI Act — it ingests Regulation (EU) 2024/1689 from the EU's own CELLAR service and answers questions about your products with clause-level citations. That is advisory output about someone else's compliance. It is separate from, and says nothing about, the platform's own posture described above.
The four things we do not claim
Article 11 and Annex IV technical documentation
We keep architecture decision records, a live feature-flag registry with review dates and an append-only migration ledger. Those are good engineering artefacts. They are not Annex IV documentation, and we will not describe them as such.
Articles 72 and 73
We have no post-market monitoring plan and no serious-incident reporting procedure in the Article 73 sense. If a high-risk classification ever applies to a deployment, those are real work items, not paperwork we already hold.
Chapter V, general-purpose AI models
Phoenix Daemon is a deployer of third-party models, not a provider of one. We do not carry GPAI provider obligations and we do not claim to have discharged the downstream duties that come with model choice — that is a live area for us.
Conformity, certification or legal advice
Our AI Act documentation is a provider self-assessment with per-control source citations. It is not a conformity assessment under Chapter III, it is not a CE marking, and it is not legal advice. Your counsel should read it as our working, not as a conclusion.
08Proof
We attack our own system, and publish the losses.
Claims about AI safety are cheap. So we run hostile exercises against the live production system — not a test fixture — and we report what happened, including the part where the attacker won.
1
Defence that was defeated
The first board was not clean. A directive concealed in an ingested document steered a later, unrelated answer. We fixed it, then re-verified by measurement rather than by assurance: five of five held, with the hostile payload confirmed ingested each time so the test could not pass by accident.
56 / 56
Held on the re-run
Across two roles against the fixed build, running live. Zero bypasses. Zero canary files destroyed or modified — scored by content hash, not by existence, so a silent truncation would still have been caught.
9
Manipulations that failed anyway
On the earlier build, nine times the model was talked into emitting a dangerous command — via multi-step escalation, disguised payloads and directives hidden inside a file it was asked to read. All nine classified irreversible. None executed. That run remains our best evidence that the floor holds when the model does not.
How the evidence works, and what our own honesty ledger saysfor audit and security readers
Tamper evidence
The chain has no side door
Every audit entry carries the hash of its predecessor and its own keyed hash. Verification walks the whole file and distinguishes deletion from in-place editing, cross-checked against an anchor held in the database. The daemon re-verifies on every boot and refuses to overwrite its anchors when they disagree. The honest ceiling: whoever holds the chain key and host root could re-sign a shortened history, so we treat off-host co-signing as unfinished work rather than a solved problem.
Adversarial review
Findings we did not like
A black-box review of the distributable, conducted from an external posture, found no malware, no backdoor and no embedded secret, and confirmed the release manifest verifies. It also raised eleven findings — several of them gaps in the trust chain rather than mere hardening — and could not reach the compiled binary itself within its sandbox window. We say so, because a review that only produced good news would not be worth showing you.
Honesty ledger
We keep a list of what is not true yet
The codebase carries a register of thirty-eight claims that documentation once made and the implementation did not support, each with a recorded disposition. Features shipping behind a default-off flag are described as default-off. Roadmap is labelled roadmap. It is an uncomfortable document to maintain and a very useful one to have.
09Who we are
A spinoff, not a startup.
NOETICS is a spinoff from eHealthBrains ↗, the Copenhagen advisory firm brought into national e-health programmes — usually the ones already in trouble.
We kept meeting the same failure: organisations running genuinely critical systems being offered AI that forgot every conversation, could not show its reasoning, and had no boundary you could point at in code. Phoenix Daemon was built to be the opposite of that. NOETICS exists to take it beyond healthcare.
Why the name. Noesis — the act of understanding, as distinct from the information understood. Our mark is two Archimedean spirals: an outer coil still accumulating, an inner copper coil already crystallised, resolving to a single point. Observe, understand, transform.
Mogens Yde-Andersen
Co-founderWorks on AI requirement analysis and implementation, and on the commercial application of AI inside organisations that must justify every deployment decision. Owns the question of what a role is actually for before anyone writes one.
mya@ehealthbrains.com
Henrik Ledgaard Ibsen
Co-founderA pioneer of e-health and virtual care in Denmark, and the founder of eHealthBrains. Has built national e-health infrastructure and remote-monitoring systems under ISO 13485 and formal quality management — where the conviction that safety belongs in code rather than in prompts comes from.
hibsen@ehealthbrains.comStart with one role.
The fastest way to evaluate this is to give it one narrow, real job — the one where institutional knowledge keeps walking out of the door — and let it run for a quarter. Everything else is a configuration file afterwards.