The behaviours a firm relies on aren’t left to prompt instructions or good intentions. They are structural properties of the product, each backed by automated tests that fail the build if the behaviour ever changes.
Two outcomes per section
A section is either grounded in enough evidence or it isn’t. The second case is stated, flagged and left for a person. There is no third path where plausible text flows through.
A tamper-evident audit
Each proposal carries a keyed chain binding the inputs, the outline, the evidence, the model identity and every section, in order. Change any link and the chain no longer verifies.
Replay against the index
Verify audit re-derives the chain and checks that every cited document is still present in your index. It runs whenever you ask, without re-running the model.
References only in the browser
Search and proposal pages show document references — file, type, discipline, pages — never passage text. The wire format has no field for it.
Access enforced in the database
A document you weren’t granted doesn’t exist for you; it isn’t merely hidden. Row-level security applies to every query, including the ones the generator makes on your behalf.
One source for firm facts
Rates, insurance limits, staff counts, licence numbers and office addresses come from the firm profile you maintain — the only place a number can come from other than the archive or your inputs.