A design-time layer that fixes, for every task class, which model may be called, what it is authorized to touch, and which decisions require a human — before any agent runs in production. Nothing is decided by the model at runtime; it is decided about the model, upfront, and enforced every time it acts.
Model routing fixed per task, not per prompt
No new fields, records, or data created outside scope
Every decision documented: rule, model, human, timestamp
Swap LLMs without changing governed behavior