Skip to content

Trust

Design commitments, not certifications

Enterprise by design: your cloud, your keys, your audit trail.

This page describes how a Solstice engagement is designed and set up. These are commitments we build each engagement around and write into its scope. They are not certifications, and we do not claim any.

Human approval

Humans approve every decision.

Agents prepare the work. People with the authority to decide, decide. That line does not move as the fleet grows.

Exhibit 1. From request to record: the approval and audit flow.

  • Approval gate. Nothing crosses without a named person's decision.
  • Audit log. Written inside your environment. Yours to keep.

  1. An agent drafts.

    A specialist agent produces the deliverable and records every source it used.

  2. Review agents challenge it.

    A separate set of agents tests each claim against its source and flags what it cannot support.

  3. A named approver receives it.

    The deliverable arrives with its sources, its flagged claims and what changed since the last version.

  4. The approver decides.

    Approve, send back with a reason, or stop the mission. Nothing is sent, filed or changed in a system of record before that.

  5. The decision is logged.

    Who decided, when, on which version, and what happened next.

Audit trail

Every action leaves a record you own.

The log is written inside your environment and is yours to keep, export and retain under your own policy.

Agent
Which agent acted, and with which permissions
Time
When, to the second
Action
What it read, wrote, built or proposed
Source
The document, record or system behind each claim
Approver
The person who decided
Outcome
Approved, sent back or stopped, and why
  1. Time: 10:20:14Actor: legal-07Action: Read contract MSA-2291, clause 14.2, change of controlOutcome: Flagged
  2. Time: 10:20:31Actor: legal-07Action: Drafted notice N-017 from approved template T-04Outcome: Queued for review
  3. Time: 11:30:02Actor: review-03Action: Challenged claim 12 in the synergy model: source cell F41 does not support the figureOutcome: Sent back
  4. Time: 11:41:50Actor: General CounselAction: Reviewed notices N-001 to N-041 with sourcesOutcome: Approved
IllustrativeExhibit 2. A few lines of an audit log, from the Acquire and integrate mission.

Data boundaries

Your data stays inside your boundary.

The fleet runs in your cloud account. The work comes to the data, not the other way round.

Exhibit 3. What runs inside your boundary, and the two controlled crossings.

  • Deployed in your account

    Agents, their working storage and the audit log run in a cloud account you own.

  • Models you approve

    Agents reach language models only through endpoints your security team has approved.

  • No training on your data

    Engagements are set up so that your data is not used to train models.

  • Named, time-bound access

    Summerland staff access is granted to named people for a stated purpose and period, and is logged.

  • Only the sources in scope

    The fleet connects to the systems a mission needs, and nothing else.

  • A clean exit

    At the end of an engagement the fleet is removed and its working data is deleted. The log stays with you.

Least privilege

Each agent gets only what its task needs.

An agent is treated like any other identity in your environment: known, scoped and revocable.

  • Every agent has its own identity. There is no shared super-user.

  • Access is scoped to the task and ends when the task ends.

  • Agents are read-only by default.

  • Any action that writes to a system of record requires an approval.

  • Credentials are short-lived and issued from your own secrets store.

  • Any agent, or the whole fleet, can be stopped by you at once.

Who does what

What Summerland operates. What you control.

Solstice is a managed service. The division of responsibility is written into every engagement.

Summerland operates

  • Designs missions and agent roles with your team
  • Deploys the fleet into your account
  • Hosts and runs it day to day
  • Monitors quality, cost and failures
  • Maintains and updates the agents
  • Reports on every mission

You control

  • The cloud account and the network boundary
  • The keys and the credentials
  • Which systems and data the fleet can reach
  • Who approves what
  • The audit log and how long it is kept
  • The off switch

What we say no to

What we will tell you no to.

Some requests we decline, whoever asks. It is better that you hear them now.

  1. Agents that approve their own work.

    Review and approval are always separate from the agent that did the work, and the final decision is always a person's.

  2. Decisions about people made without a person.

    Hiring, firing, pay, performance and discipline stay with accountable people. Agents can prepare the analysis. They do not decide.

  3. Sending anything outside your company without sign-off.

    No customer notice, regulator filing, supplier letter or press statement leaves without a named approver.

  4. A fleet running where you cannot see the log.

    If you cannot inspect what the agents did, we will not run them.

  5. Certifications we do not hold.

    We will not claim a certification or attestation we do not have. Ask us what is in place for your engagement and we will show you.

  6. Numbers presented as results before there are results.

    Solstice is new. The scenarios on this site are illustrative, and are labelled that way. A pilot is measured against your baseline before we quote a result.

  7. Starting at enterprise scale.

    Every engagement starts with one agent on one mission. The next stage is earned by the result of the one before.

Bring your security team.

The first conversation in a pilot is with the people who will have to say yes. We would rather answer the hard questions before the work starts.

Start a pilot