MagWorksManaged Intelligence

Trust, audit and operations

In plain language

This is the long form of the Technical page on matterandgas.com. A client's Solution is isolated to the client, every run is on the record with its exact cost, the platform is operated with alarms that are themselves recorded, outward actions are gated, and the system is designed on the assumption that models are sometimes wrong. Where a mechanism has a production event behind it, this page says so.

Tenant isolation, end to end

  • Every row that could carry customer-derived state carries tenantId (I-26); the records store keys every partition by tenant, so cross-tenant reads are structurally impossible at that layer.
  • Knowledge is owned at intake, retrieved only within the owning or granted set, with a mandatory serving-tenant argument and refusal on absence (INV-KNOW-01…03). Vector storage keys and query filters carry the tenant.
  • File storage is tenant-prefixed and KMS-encrypted; uploads go straight to storage by signed URL.
  • Prompts are tenant-owned assets resolved by identity and authorised after resolution (ADR-0036).
  • Leak rigs run in continuous integration as executable invariants, and the tenant-isolation suite blocks deploys.

The ledger and replay

  • The audit ledger is append-only, actor- and correlation-stamped, separately backed up, recoverable to any point in time and never purged (INV-LED-01…06).
  • A run record is the run, its node runs (one per action: attempt count, status, input snapshot, output, timing), its per-transition WorkflowExecution rows with a contiguous state-hash chain, its AiExecutionRun rows (every model attempt with provider, chain ordinal, status and routing decision), its ToolInvocation and HumanReview rows, and its cost records.
  • Replay reconstructs a run from substrate alone (I-20); inspect, compare, replay and redrive are operator tools, and a replay is itself a ledgered event.

What "exact cost per run" means

  • Every executed action emits a measurement identified by (Capability, Run, ActionInstance, MeasurementKind); a producer that cannot fill all four fields does not emit, and the gap surfaces as a reconciliation candidate (I-13).
  • Measurements map to cost records by pure translators; cost records are append-only, stamped with the rate in effect at write time (I-18, I-25), and attributed to the Solution server-side.
  • Every operator-facing financial number is a projection over cost records (I-29 forbids synthesising one). Cost is divided at a documented aggregate boundary and never stored undivided.
  • Production events: a durable 105-second job with exact dollar reconciliation; single runs attributed run → Solution → configuration version → tenant at sub-cent precision; streamed runs producing the same cost truth as buffered ones.

Operations

  • Least privilege per function. Each of the 48 Lambda functions has its own execution role; data-source roles are scoped to invoke exactly one function; KMS decrypt grants carry encryption-context and alias conditions.
  • Edge protection. Public surfaces sit behind AWS WAF with the Common Rule Set, Bot Control and a per-IP rate limit before any request reaches compute (INV-SEC-03).
  • Alarms that are themselves recorded. A baseline alarm fires on error-level log entries; a per-function alarm fires on any Lambda error; both notify through SNS, and an alarm-to-ledger function appends an AlarmFire ledger entry for every alarm state change — so an incident's timeline is in the same record as the runs it affected.
  • Dead-letter queues with alarms. Knowledge ingestion and Solution webhook delivery each have a 14-day dead-letter queue with an alarm on depth ≥ 1. Every event subscription has a dead-letter target.
  • Bounded retries and permanent-failure marking. Jobs declare retry, max attempts, timeout and dead-letter target explicitly; poison messages are marked, not looped. A poison-message drill was run in production and caught a real error-code clobber, which was fixed.
  • Recovery evidence. A quarterly recovery drill restores from point-in-time backup and appends a RecoveryEvidence ledger entry on every run, success or failure.
  • MFA. Operator sign-in uses TOTP; operator roles require it.
  • Structured logs and correlation. Every log entry is structured JSON; every request and event carries a correlation id from ingress to downstream calls; the logger redacts credential-shaped values.
  • Governed change. Every production write is a registered operation with dry-run, approval, verify and ledger — see the kernel.

Offboarding

The offboard-client operation erases fifteen categories of a client's data in an order that severs access first and proves what was removed; what is retained (the append-only ledger, cost records, immutable registries, disabled accounts, the retired Solution record) is stated in the runbook and covered by the client contract. It was rehearsed in production before the first client corpus was ingested.

Designed for models being wrong

  • Grounding fails closed: an empty allowed set is an honest empty answer.
  • Structured output is validated at the boundary and enforced by constrained decoding where the model supports it; degradation is measured, never silent (ADR-0039).
  • Routing is validated against declared model capabilities before a run starts (ADR-0020); fallback is a recorded recovery move, not a guess.
  • Cost ceilings and rate quotas refuse before a provider is called (ADR-0022).
  • Human review sits between generation and consequence where policy requires it; edits are recorded; outward actions are allow-listed (ADR-0014, Gate A).
  • Publication requires evaluation evidence bound to the exact content hash (I-21).
  • Fit at the Front Door is judged in words, never a number, and a poor fit is said plainly.

Would rather check than trust?

Ask Matter & Gas for the run ledger for your own Solution. Everything on this page is readable there.

Sources

  • matterandgas-com/amplify/backend.ts, amplify/custom/alarms.ts, amplify/custom/waf.ts, amplify/functions/alarm-to-ledger/, recovery-drill-quarterly/, amplify/auth/resource.ts.
  • magpie/docs/architecture-constitution.md — INV-LED, INV-OBS, INV-SEC, INV-IAM, INV-DEP.
  • matterandgas-com/docs/runbooks/offboard-a-client.md, knowledge-ingestion-recovery.md, logging-and-correlation.md.
  • matterandgas-com/app/_front-door/_components/security-panel.tsx — the short form.