Overview
One customer, one pane. Everything here is read from the same ledger your customer sees, that symmetry is the product.
Requests · 24h
21,627
93.8% sovereign · 5.8% resident · 0.4% human
Cost MTD vs budget
£41,208
68% of envelope · tracking under
Blended p95 · single-shot
1.61 s
cache hit 51.2% across classes
Drift flags · this week
3
2,104 outputs sampled · 0 version changes
Start here
The two surfaces that define this tenant.
POLICIES · 14 RULES
Plain-language rules across 5 domains, plus the residency matrix. 2 locked regulatory baselines, 3 customer overrides of your OEM base policy.
TASK CLASSES · 11 DEFINED
9 live, 1 paused, 1 draft. Per-class envelopes, pinned models, pricing shape, and 30-day underwriting variance, searchable and editable.
Policies
Policy you can read. Each rule is the enforcement logic, rendered as the sentence the customer's IG lead signs. OEM BASE rules ship with your product; OVERRIDE rules are this customer's departures. Toggle anything unlocked and it becomes a v13 draft, nothing changes until simulation and dual sign-off.
VERSION HISTORY
v13, draft
you · 2 changes pending
v12, live
11 Mar 2026 · dual-signed
v11
28 Jan 2026 · RES tier enabled
v10
02 Dec 2025 · go-live baseline
Data residency & sovereignty · 4 RULES + MATRIX
identifiable data never leaves SOVEREIGN-UK infrastructure.
LOCKED · UK GDPR / NHS DSPT baseline · cannot be disabled in any draft
de-identified tasks may use RESIDENT-UK frontier capacity, always via the de-identification gate.
Re-ID map held sovereign · enabled 11 Mar 2026 · signed Okafor / Whelan
pseudonymised payloads may transit RESIDENT-UK for priors.synthesise.* classes only.
Class-scoped grant · all other classes remain sovereign-only for this data class
synthetic workloads may use OPEN pools where economics dominate.
Disabled, Trust X declined the Open tier at onboarding. One toggle to draft.
| Sovereign-UK | Resident-UK | Open | |
|---|---|---|---|
| identifiable | |||
| pseudonymised | |||
| de-identified | |||
| synthetic |
Click any unlocked cell to cycle ALLOWED → VIA GATE → BLOCKED in the draft. The top row is statute, not preference, it does not cycle.
Model governance · 3 RULES
Model changes for any task class require an eval-suite pass ≥ 98.5% and dual sign-off before serving traffic.
LOCKED BY OEM · applies equally to SOV and RES pools · Clinical Safety + Information Governance
Sovereign models are pinned for the life of product certification; rollback versions are held warm.
3v-rad-32b@2.3.1 pinned since 14 Feb 2026 · rollback 2.2.4 warm in LHR
Resident-pool deprecations raise an alert at ≥ 6 months horizon and a staged migration plan within 30 days.
claude-frontier UK horizon: 11 months · migration plan filed 02 Jun 2026
Escalation & human oversight · 3 RULES
priors.synthesise.oncology escalates to the consultant queue below confidence 0.80.
12% of volume escalated last 30 days · every case enriches the eval bank
qa.discrepancy-check escalates below confidence 0.75, and always when a discrepancy is found.
4.1% escalated last 30 days · found-discrepancy rate 1.4%
1.5% of routine outputs are sampled weekly and scored against the governance rubric.
This week: 2,104 sampled · 3 flags · rubric mean 4.6 / 5.0 · trend stable
Economic controls · 2 RULES
Per-class budgets are hard caps; breaches queue rather than spend.
Soft alert at 80% · hard stop at 100% · CFO digest every Monday 07:00
Batch-eligible classes run in the overnight trough (23:00 to 06:00 local) at deferred priority.
worklist.triage + priors backfill · lifts LHR pod utilisation 22 points overnight
Audit & retention · 2 RULES
Ledger entries are retained 8 years, immutable, in-jurisdiction.
LOCKED · NHS records-management alignment · exceeds EU AI Act minimums
The customer holds full read access to their own ledger and evidence packs, at all times.
Both parties read the same rows, that is what makes the contract honest
Task classes
A task class is a unit of clinical work with a policy, a model, an envelope, and a price. Search, filter, and expand any row, envelope steppers create v13 draft changes, never live edits.
Model registry
You select clinically; Heimdall enforces and supplies. Pinning is absolute on owned weights, managed on resident pools, and the registry says which is which, out loud.
3v-rad-32b @ 2.3.1PINNED · SOV
Radiology-tuned · owned weights · Bifrost LHR
Eval: 412-case suite · 98.7% · 14 Feb 2026
Pin term: life of product certification
Rollback: 2.2.4 held warm
Eval: 412-case suite · 98.7% · 14 Feb 2026
Pin term: life of product certification
Rollback: 2.2.4 held warm
SERVES 5 CLASSES
claude-frontier · UKRESIDENT
Frontier reasoning · in-country deployment
Eval: oncology-synthesis suite · 99.1%
Deprecation watch: horizon 11 months
Migration: staged, behind the same eval gate
Eval: oncology-synthesis suite · 99.1%
Deprecation watch: horizon 11 months
Migration: staged, behind the same eval gate
SERVES 2 CLASSES
3v-rad-32b @ 2.4.0IN EVAL
Candidate · improved priors handling
Suite progress: 251 / 412 · 0 regressions
If passed: enters approvals, never auto-serves
Suite progress: 251 / 412 · 0 regressions
If passed: enters approvals, never auto-serves
ETA 9 DAYS
3v-tri-8b @ 1.6.0PINNED · SOV
Triage distil · owned weights · batch-scheduled
Lineage: distilled from frontier traffic, 2025-Q4
Cost: overnight trough · effectively utilisation
Lineage: distilled from frontier traffic, 2025-Q4
Cost: overnight trough · effectively utilisation
SERVES 2 CLASSES
3v-gen-8b @ 3.1.2PINNED · SOV
General language · transcription + coding
Eval: language suite · 99.4%
Tokenizer note: clinical-vocab extended, 18% fewer tokens/report than generic
Eval: language suite · 99.4%
Tokenizer note: clinical-vocab extended, 18% fewer tokens/report than generic
SERVES 2 CLASSES
Simulation & approvals
No policy goes live on a promise. Drafts replay against the tenant's actual ledger, and the impact is shown before anyone signs.
Draft v13, changes
2 changes pending (plus any you draft in this session).
rule: priors.synthesise.oncology
- escalate below confidence 0.80
+ escalate below confidence 0.85
envelope: report.draft.ct-chest
- max_input_context: 8192
+ max_input_context: 10240 # 4-prior cases
- escalate below confidence 0.80
+ escalate below confidence 0.85
envelope: report.draft.ct-chest
- max_input_context: 8192
+ max_input_context: 10240 # 4-prior cases
Clinical Safety Officer✓ SIGNED · DR A. OKAFOR · 09:12
Information Governance● PENDING · J. WHELAN
REPLAYED IMPACT · 30 DAYS
Requests re-routed+412 to human tail (12% → 19%)
p95 latency · report.draft1.74s → 1.91s (larger context)
Cost delta · monthly+£1,840 (+4.5%) · within cap
Sovereignty impactnone, tiers unchanged
Per-study price impactnone this term · review at renewal
Consultant queue load+14 cases/week · confirm staffing
Ledger & evidence
Live feed below; evidence packs are generated from it on demand. Compliance as exhaust, not as a project.
TimeTask classModel @ versionTierTokens / callsLatencyPricing
09:41:07report.draft.ct-chest3v-rad-32b@2.3.1SOV-UKin 6,214 (3,090 cached) · out 4821.74sper-study
09:41:09priors.summarise3v-rad-32b@2.3.1SOV-UKin 4,890 (2,950 cached) · out 3010.88sper-study
09:43:51report.draft.cr-chest3v-rad-8b@2.1.0SOV-UKin 2,610 (1,480 cached) · out 2960.61sper-study
09:52:33priors.synthesise.oncclaude-frontierRES-UK11 calls · in 48,910 · out 6,24041.2smetered
09:53:14escalation.consultanthumanQUEUEconfidence 0.71 < 0.80n/aplaybook
09:58:41qa.discrepancy-check3v-rad-32b@2.3.1SOV-UKin 9,412 · out 3882.31sper-study
The evidence buttons produce the board pack on our example audit page.