Built like the evidence depends on it.

Multi-tenancy is enforced structurally, not by convention. Every query path runs behind Postgres row-level security scoped to the tenant, so an application bug cannot become a cross-tenant data leak — the database itself refuses cross-tenant reads and writes.

Within a firm, each client's memory and conventions are separated: one client's coding history never informs another's unless the firm explicitly marks a convention as firm-wide.

Every inference payload passes through a PII-masking gateway before it reaches a model: names of natural persons, government IDs, addresses, and account numbers are replaced with stable pseudonymous tokens. The re-identification map stays in our infrastructure, and model responses are re-hydrated there.

One limitation we state plainly, because it matters: masking operates on text. Document images sent for vision extraction are not redacted, so identifiers visible on a scanned statement or payroll summary do reach the model provider. In-cell zone redaction for high-PII document types is planned and not yet built.

Inference runs under zero-data-retention terms, and client financial data is never used to train foundation models. Prompts carry only the fields a task needs, and the same masking applies to logs.

Finalized entries are never edited in place. The finalized ledger is append-only double-entry; corrections are explicit adjusting or reversing entries linked to the original, so the record of what changed — and why — is itself part of the books.

Closing a period locks it: the service refuses new journals and in-place edits against a closed period, and corrections go through the same sign-off workflow as everything else.

Every agent action is recorded with its trigger, the retrieved context, the tool calls and their results, each factor of the autonomy decision, the verification-gate result, the outcome, the human who resolved it if any, and the pinned model version and configuration.

The log is append-only — the application role holds insert and select rights and nothing else. A reviewer can see exactly what the agent saw and why a gate passed or failed.

The agent is a preparer, never an authorizer. Every binding action carries an approval token that only the policy engine can issue; the services that touch the ledger verify that token's signature and refuse to act without it. Tokens are Ed25519-signed, single-use, and bound by hash to the exact request body they authorize, so an approved action cannot be swapped for a different one.

A material item that fails a verification gate can only proceed by an explicit, attributed, logged human override — never by the agent retrying until it passes. Finalizing a period always escalates to a human.

A kill switch drops any firm or client to fully supervised mode instantly, without losing state or work in progress.