Custos
Private AI over internal documents, with retrieval-time authorization, cited answers, and human approval before tools can create real-world effects.
Restricted documents are removed inside the vector query. They never enter the candidate set, context window, answer, or citation.
Engineering evidence
A documented suite of 61 adversarial evals covers eight documented threat classes, alongside automated application tests. The permission filter runs inside the vector query, so a restricted document is never a candidate for the answer. Qdrant and pgvector backends exercise the same contract. Tool calls are order-dependent, and a poisoned-document test verified that real-world effects cannot execute without explicit human approval. The public demo uses simulated access roles plus per-IP and per-session limits; production identity must come from authenticated users.
