Security and custody

Your control stays yours.

TEMRAL governs a narrow cost scope. Providers, credentials, access, policy, rollout, and rollback remain under your authority.

Custody boundaryAuthority does not move with the workload.

You retain

Provider selection: Your team chooses the provider and model lane.
Deployment decision: Your team decides whether TEMRAL is deployed or removed.
Access and policy: Your team keeps control of credentials, roles, and policy.
Pause and rollback: Your team retains the ability to pause, reverse, or exit.

TEMRAL governs

Governed scope only

Admit scope. Verify outcome. Bind evidence. Issue receipt.

The receipt states

IncludedAuthorized scope, provider record, admitted result, economic impact.

ExcludedPrompt content, internal workflow steps, downstream business outcomes.

Held by youCredentials, access, policy, deployment, and rollback authority.

Operating contract

Authority is assigned before anything moves.

Security review should reveal who owns each decision, what is observed, and what remains outside the claim.

What TEMRAL governs

A narrow, explicit cost-governance scope with a bounded receipt.

What stays with you

Provider choice, deployment authority, access, policy, and rollback.

What the receipt proves

Only the admitted scope, provider lane, and observed economic result.

What TEMRAL does not claim

Workflow control, prompt content, future outcomes, or blanket security certification.

Operational safeguards

Concrete controls without certification theater.

Key isolation

Raw credentials never enter the public receipt surface.

Least privilege

Tenant and role scope bound every operational action.

Evidence integrity

Receipt fields are bound against silent mutation.

Reversible rollout

Your team retains pause, rollback, and exit authority.

Prove fit without surrendering control

Start with one admitted workload.

No production move follows without an admitted result and your decision.