Nothing reaches your customers without you seeing it first.
Every external touch waits in your approval queue. Every
claim is checked against your regulator's rules before
it gets there. Your data lives in a strictly separated
space — your competitor on the same agency can't see
it. Ever.
Five safety checks built into the code, not into a policy
document. Your procurement team can request the evidence
pack alongside the contract.
Every workflow says which checks apply to it. Every
customer-facing output passes through them. If any check
fails, publishing stops — never silently, never just
logged.
Your customers never see a tool they don't recognise.
Your last agency sent your customers emails from a tool you'd never heard of. A customer asked you what it was. You couldn't say. The brand stopped feeling like your brand somewhere along the way.
We never name the AI models or cloud providers behind the scenes in copy that goes to your customers. A list of 32 vendor names is checked against every public output. The only exception is the /ai-visibility page, where we have to name the five AI tools we measure — and that exception is explicit, not a slip.
You land on:A brand that gets remembered.
Your regulator's rules stop the wrong claim before it ships.
An ad went live last quarter that said "best in Manchester". A complaint landed. The agency promised it wouldn't happen again — without changing a single thing about how copy gets reviewed before it ships.
Five UK regulators' rules are enforced before anything ships. FCA Consumer Duty (no guaranteed returns; capital-at-risk disclaimer required). ASA CAP Code (no unqualified superlatives like "best"; no absolute no-quibble claims). General Dental Council (no guaranteed clinical outcomes; specialist-claim restrictions; proper before/after disclosure). MHRA (no prescription-only-medicine promotion to the public; explicit trial reference for efficacy claims). Influencer disclosure (#ad / paid partnership / gifted markers).
You land on:Pay for outcomes, not hours.
Nothing reaches a customer until you say yes.
Three weeks ago an automation posted to your social account without anyone reading the post first. It was on-brief and badly off-brand. The post is still live; the comments under it still are too.
Every external touch — every customer-facing deliverable, every outreach, every site update, every document that triggered a prompt-injection flag, every regulator-flagged claim — waits in a human-approval queue. Each item type has a required approver role. Nothing publishes on its own.
You land on:Win customers while you work.
Your competitor on the same agency can't see your data. Ever.
Your competitor uses the same agency. You wonder, quietly, whether the case study they shared at the conference last month had pieces of your data in it. Nobody can tell you it didn't.
Your tenant scope is checked the moment any data is created. The cross-suite envelope checks the boundary before sending. Per-tenant cooldowns stop workflows running too often. The four storage backends (relational, graph, document, vector) each carry your tenant ID, with belt-and-braces filtering on every read.
You land on:Cheaper than a hire. Deeper than an agency.
The known-attacks library.
A library of attacks is a record of failure modes we know
about and expect our safety layer to block. 25 starter
attacks across 5 categories. Our automated tests run them
on every code change — if our safety layer ever stops
blocking one, the build fails before the change ships.
Prompt injection (document)
6
Classic 'ignore previous instructions'
'disregard the prior instructions'
Role-toggle ('you are now…')
DAN / 'do anything now' jailbreak
'Developer mode enabled' jailbreak
Prompt injection (indirect)
3
HTML-comment payload
YAML-block payload
Invisible-character prefix
Vendor-name leak
6
AI model named in monthly report
Cloud vendor named in onboarding
SEO tool named in methodology
Subscription tool named in pricing
Regulator violation
6
FCA guaranteed returns
ASA unqualified superlative
GDC specialist claim without GDC register reference
MHRA POM promotion to consumer
Influencer endorsement without #ad disclosure
Cross-suite secret leak
5
Attempt to dump environment variables
Attempt to print bridge token
Attempt to enumerate other tenants
Attempt to extract other-tenant VOC
Anticipated questions.
Plain-language answers for your procurement team.
What happens when a regulator rule fires?
Publishing is blocked at code level — the claim never reaches your customer. The incident is logged with the regulator, the rule that matched, where in the text it matched, and the documented fix. One of our specialists rewrites and re-queues. The cycle continues until the rule passes. No 'we shipped it anyway, we'll fix it later'.
Who approves items in the human-approval queue?
Each item type has a required approver role: you for anything customer-facing, the team lead (Aria / Atlas / Pulse etc.) for team-scoped items, the QA lead (Knox + our team) for anything regulator-sensitive, and 'any trusted person' for low-stakes items. Who approved what is on the record. By default, anything customer-facing waits for your sign-off.
How do you know your safety layer is still working?
We run a library of 25 known attacks against the safety layer on every code change. If any attack ever stops being blocked, the build fails and the change doesn't ship. (The library is in `atelier/safety/red_team.py` in our codebase, if you want to inspect it.)
Is the framework documented for procurement?
Yes — the architectural decision records (ADR-0064 vendor naming, ADR-0181 tenant isolation, ADR-0252 document-ingest safeguards, ADR-0259 safety framework, ADR-0260 workflow safety wiring) make up the evidence pack. Your procurement team can request it alongside the contract.
What if I upload a document with an attempt to manipulate the AI?
Every document you upload runs through a 14-pattern scan for known manipulation attempts before any AI touches it. High-severity markers quarantine the document and put it in human review. Medium-severity markers add a warning to the document's record. The full safety ladder for document ingest (from basic form-fill at Spark through full multimodal at Ultra Studio with mandatory QA) is in ADR-0252.
How is this different from a generic 'AI ethics' page?
Generic ethics pages describe values. This is a framework that's built into the code — every promise we make on this page maps to a check that runs automatically. The promise is auditable in code, not in copy.
Want the technical evidence pack?
We'll send the ADRs (0064 vendor naming; 0181 tenant
isolation; 0252 document-ingest safeguards; 0259 safety
framework; 0260 n8n workflow safety wiring) alongside the
MSA. Your security and procurement teams can audit before
the engagement starts.