Evidence Lab

A MeshGroup admits a request only when the tenant matches, the group exists, the data classification fits the group's ceiling, and a healthy, authenticated node on an allowed site serves the model. Other sites stay closed unless policy enables cross-site use and the request consents. The node with the most free memory wins; ties go to the earlier node.

The ThoxWork routing planner answers a narrower question than admission: which bound node may this person or Digital Employee plan on, and why is every other node refused? Early denials stop the wrong organization, revoked or unauthorized principals, a Digital Employee whose sponsor lacks the same access, and unbound resources. Cross-site, remote and relay use need all three policy levels to allow them. The planner is a preview: it never executes, authorizes or falls back to hosted processing.

Two controls stand between a Digital Employee and an effect. The action gateway fails closed: a deployment ceiling no tenant can widen, unknown actions, tenant deny lists, channel membership (modelled here as workspace membership), secret markers and a size cap, in that order. The approval gate holds an assignment before any external effect for any of four reasons; only a person can decide, once, and each request names and records the role required to decide it. Role names here are illustrative.

Pick a team in order, then run the brief. Each member writes a handoff whose hash commits to the brief, the member and the previous handoff. Work reaches Done only after a person approves it in review. Built today: each handoff carries the hash of its own body. Proposed here: each hash also commits to the previous handoff, so an insider who edits a step and rewrites its body hash is still caught.

Each test copies the current ledger, applies one attack, and checks the copy three ways: hash links alone, hash links plus the session HMAC key, and hash links plus an anchor (record count and head hash held by a second party). The live ledger is never changed.

Attach screenshots, screen recordings or PDFs taken during a run. The lab hashes each file in your browser and writes its SHA-256 into the ledger, so the capture and the record vouch for each other. Snapshot lab state renders the ledger head as a PNG and captures it the same way.

Numbers measured for the THOX ThoxWork technical report with the same code this page runs. They describe one host and the stated repetitions; see the report's limitations before you generalize.