THE PROBLEM
Four questions decide whether it ships
Teams are putting agents in front of production operations. When it matters, four questions decide whether it goes live — is it grounded, is it safe, what did it cost, and what did it actually do. Most deployments cannot answer any of them with evidence, so the agent either ships unaccountably or does not ship.
GROUNDING
Every claim points at a passage
Citations attach to sentences, not to responses. A model that puts one marker at the end of six sentences has cited one and asserted five. A marker pointing outside the evidence is recorded as unresolved rather than dropped — a fabricated citation looks exactly like grounding, so it has to survive where a check can see it.
REFUSAL
It says when it does not know
Refusal is gated on signals measured to separate answerable from unanswerable, not on a score that reads the same for both. Thresholds come from explicit error budgets against 715 labelled questions whose labels are true by construction rather than assigned by a model.
DETERMINISM
Routing is a decision, not luck
Providers are attempted in a fixed order. Two identical requests take the same path, which is what makes a trace worth reading and a failure worth reproducing. Nothing here reads a module global or the wall clock.
COST
Most of the work costs nothing
If a typed rule can decide it, no token is spent. Five of seven nodes in a typical run are deterministic and take 13 milliseconds between them, against 14 seconds for the two model calls. The governance layer is close to free — which is the argument for deciding as much as possible without a model, stated as a number.
GOVERNANCE
A risky action stops for a human
The approval node has no edge back into the graph. Reaching it ends the run, and a decision starts a new one carrying the record. It is enforced by topology rather than by care, because an approval step that can auto-proceed consumes a reviewer's attention and protects nothing.
ECONOMICS
Cost is bounded before it is incurred
No live model call happens without an open budget. Every call is priced at worst case before it fires and reconciled after. Pricing after the fact is accounting; pricing before is control.
A NOTE ON WHAT THIS IS
SandScope is a demonstration product built to production standards on synthetic data. The engineering is real — the services, the failover, the retrieval, the evaluation, the pipeline. The customers are simulated, and saying so is cheaper than being found out.
Every number on this page is measured and reproducible from the repository. Ten defects found during the build are published, including the six that only appeared once the assembled system was actually run.