Orthion — “Exactly what the LLM sees”

A governed metric crosses to an AI assistant as a MetricContext: a number it did not compute, its lineage, and an egress receipt proving no PII left. · CFO receipt view (v1) →

🔒 Air-gapped demo — no LLM is called. This is the exact governed context an LLM would receive; the model never computes the number.

Scope principal is a demo control — it visualizes propagation. In production the principal comes from the authenticated MCP session (OAuth); it is not client-settable. (Auth-debt tracked → Slice 7.)

Layer 2 — Grounded policy citations

A policy question crosses to the assistant as a PolicyContext on the same governed gateway: cited clauses it did not author (each above the re-rank gate) with an egress receipt — or a governed refusal. No LLM composes an answer.

The gateway preloads the in-box embedder + cross-encoder at startup (resident, ~1.5 GB) so policy queries serve immediately — no per-request model load.

Layer 3 — Member context (tokenized, minimized) + the walled act

A member surface reaches the assistant as token-keyed, minimized context on the same gateway (serving role, no owner access): no member_key, DOB, or address ever. Scope is per-user; suppression + refusals are governed. The re-identify → act step is NOT here — it lives behind a wall.

Switch the principal to see scope-differential data live over MCP — analyst_tx ≠ analyst_ca, and an unentitled principal is fail-closed empty.

🧱 Walled in-boundary act — the act_outreach re-identify→act step runs in a separate owner-credentialed process, never an MCP tool, never on the LLM path. It resolves token→identity inside the boundary and returns an identity-free receipt. Open the walled act console →