Tvijo

tvijo-policy-axes-v3

Axes that change requirements, and what stays fixed

This page lists the axes that change requirements for content and platform work, the lifecycle dimensions that describe how an agent acts, and the invariants that do not change. Each axis names what varies and what we keep fixed; a profile declares the conditions under which a task runs.

Policy revisions

v1 — first public policy14 axes, 6 profile fields, 9 invariants, 7 checks.
v2 — Astra review appliedNine lifecycle dimensions; age separated from AI-content labelling; profile fields for residency, jurisdictions, language, intermediary, organization and accessibility; data flags split; checks before egress; guarantee status.
v3 — Opus 5.5 review appliedModel profile as the other half of the filter, including content policy; hard vs soft filters; precedence and unknown values; claim ladder; filters by audience; NIST AI RMF gap map; model lines recorded side by side.

Model lines

The question: should we keep paying to prove that rule packs save money, and what must a person decide? Rule packs already run; their savings are not proven; the first comparison run was contaminated, and the second stopped on a detector for “the agent may have read the fix” and was rejected by the independent judge.

Human decision · safe defaultDeepSeek V4.1 FlashDevstral 2512Astra 6 UltraOpus 5.5GLM 5.3 FlashMiMo 2.6 Flash
Pay for a clean comparison run
Only after isolation; one capped run.
agreenot askednot askedamendagreeagree
Claim savings in public
No, until the pre-set thresholds pass and receipts are independently checked.
agreenot askednot askedamendagreeagree
Isolation before UI work
Isolation first (no model calls); UI may run in parallel.
agreenot askednot askedagreeagreeagree
Apply packs to our own agent rules
Only after the method is proven; the safety core is never shortened.
agreenot askednot askedamendamendamend

DeepSeek V4.1 Flash

Tvijo terminal

Answered the operator: does a person need to fill in a questionnaire to decide?

No questionnaire. Only three decisions belong to a person — money, publicity and priority — and each has a safe default. Isolation and a deterministic leak check come first; they need no model calls.

  • Replace the heuristic “peeked” detector with a byte check: the fix must be absent from the snapshot.
  • Snapshot from an archive into a fresh repository without remotes or history; offline network; result written into the receipt.
  • Calibrate the detector on a clean and a planted snapshot: PASS on the first, FAIL on the second.
  • Fail the thresholds → packs stay UX presets and the initiative is culled with an autopsy.

Disagrees: None stated; it set the defaults the other lines answer.

2026-10-21 · answer took 43 s · receipt not attached to this page

Devstral 2512

DSHREM, read-only

Drafted policy v1: axes, profile fields, invariants.

No political packs. Jurisdiction, sector, risk appetite, licenses and privacy change requirements far more than party politics.

  • Neutral tool plus sector profiles; no custom value variant per client.
  • Named the segmentation risks: echo chambers, capture, complaints, fragmentation.

Disagrees: Not asked about rule packs.

2026-10-21 · three metered calls, USD 0.029 in total

Astra 6 Ultra

independent judge, read-only

Reviewed v1 into v2; judged the second comparison run.

The same axis values fit an agent that proposes a change and one that ships it, but authority and impact differ — hence nine lifecycle dimensions. The second run is rejected: the detector hit does not prove the fix was read, and the trace cannot prove it was not.

  • Split age from AI-content labelling; split visibility, personal data and sensitivity.
  • Unverified outcomes stay unverified: continuing the rejected run is forbidden.

Disagrees: Its verdict is why the defaults exist; it was not asked to vote on them.

2026-10-21 · subscription session, no API spend

Opus 5.5

Claude Code, author of v3

Reviewed v2 into v3 and answered the rule-pack question.

The blocking gap is method, not a human choice. Axes describe only the task; model choice needs a declared model profile, hard filters that exclude, soft filters that rank, and a fixed precedence. Savings are compared per accepted result.

  • Money for a run: only after the detector is calibrated and the cap covers the whole task matrix — a partial run proves nothing.
  • Public claim: measure cost per accepted result, require two isolated runs, publish failures next to successes.
  • Own agent rules: the safety core is an enumerated list guarded by a test, so “never shortened” is checkable.
  • When every line agrees, look for a shared blind spot before acting: agreement is advice, not evidence.

Disagrees: DeepSeek: “85% of cost” is undefined — per task, a pack that quits early looks cheaper while failing more; count per accepted result. GLM: political regime and religious law become hard only through a named legal obligation, never as a ranking of people; and a culled entry is kept with its autopsy, not deleted.

2026-10-21 · subscription session, no API spend

GLM 5.3 Flash

DSHREM, read-only

Answered the rule-pack question and the model-choice question.

Agrees with DeepSeek on isolation, the public-claim thresholds and parallel UI. Jurisdiction and financial and data regulation are hard filters; the nine lifecycle dimensions should rank, not gate.

  • Hard filters it lists: political regime, religious law, sanctions, data jurisdiction, financial and sector regulation, licenses.
  • Missing axis: reproducibility — two runs of the same pack must state whether the result is stable.
  • Missing invariant: provenance — which model produced each line of evidence must be recorded.
  • People decide money caps, what counts as verified savings, closing an initiative and changes to the axis policy; models only propose.

Disagrees: DeepSeek on the fate: a failed run should not remove the pack — keep it labelled “preset, not savings” with a dated public autopsy.

2026-10-21 · one metered task, USD 0.0022, 10,679 tokens

MiMo 2.6 Flash

DSHREM, read-only

Answered the rule-pack question and the model-choice question.

Axes work as model filters only when split: jurisdiction, licenses, labelling and sector rules exclude a model; the rest only rank it. Accepts the rule-pack defaults with one amendment on the safety core.

  • v2 describes the task, not the model: without a rule for what excludes and what reorders, the “filters” cannot be implemented as written.
  • No precedence when axes conflict: two agents can pick opposite models from identical answers.
  • Axis values carry no source date or valid-until, while laws, licenses and sanctions change: a hard filter can go stale silently.
  • If hard filters leave zero candidates, people choose; the safe default is no model.

Disagrees: Astra 6 Ultra, partly: the lifecycle dimensions fixed “propose vs ship” but describe runs, not model eligibility. Treats political regime and religious law as soft — the opposite of GLM.

2026-10-21 · second attempt completed, USD 0.0028, 15,517 tokens; the first attempt failed (USD 0.0073) and is kept in the record

Lines are advice, not votes. A person decides on money, public claims and priority; lines agreeing with each other does not make them right.

Axes

Political regime

Censorship rules, content restrictions and electoral cycles change what may be published or must be labelled. Party politics by itself rarely changes a product requirement.

Fixed: No party, candidate or state ideology is promoted; every obligation is stated together with the jurisdiction that creates it.

Religion and religious law

Religious norms and religious law affect content, finance and calendar rules where they are part of the applicable legal order or of the client’s declared policy.

Fixed: Using the product does not require adherence to any religion; religious-law profiles are opt-in and declared by the client.

Data jurisdiction and residency

Storage, processing and transfer rules depend on three different jurisdictions — operator, user and storage region — and they are not interchangeable.

Fixed: Storage region is declared per profile; personal data is not moved outside it without an explicit decision.

Sector regulation

Sector rules add obligations: health, legal, public sector and education carry their own evidence, retention and audit requirements.

Fixed: Safety checks on generated code and commands stay the same in every sector; sector rules add requirements and never remove them.

Financial regulation and risk appetite

Payments, reporting, suitability and risk limits depend on the financial regime and on the client’s declared risk appetite.

Fixed: Money is reserved before work and recorded in a receipt; no financial action bypasses the ledger.

Sanctions and export controls

Access, distribution and end-use restrictions depend on sanctions and export-control regimes; they are not a matter of preference.

Fixed: Sanctioned parties and prohibited end uses are refused; availability never overrides screening.

Licenses and intellectual property

What may be copied, modified or redistributed depends on the license of each dependency and on the client’s IP rules.

Fixed: Every dependency license is checked against the declared allowlist; unclear licensing blocks the change.

Commercial model

Advertising, subscription, marketplace and open-core models create different duties to users and different disclosure requirements.

Fixed: Prices and limits are published; there is no hidden charge and no silent auto-renewal.

Environmental requirements

Sustainability requirements and reporting duties depend on jurisdiction and on the client’s own commitments.

Fixed: Energy and routing claims are reported as measurements with a source, or not reported at all.

Public good and social expectations

Expectations about open access, education and public benefit differ between communities and funders.

Fixed: No harmful content or capability is enabled by a commercial, social or charitable argument.

Culture and language

Localization, formality, imagery and calendar depend on the audience and the language declared in the profile.

Fixed: Translations are labelled; the original meaning is not silently changed.

Age and digital literacy

The same capability needs different pacing, wording, supervision and examples for a 12-year-old, a 17-year-old, a student and a manager. Teachers and parents may need to approve the result.

Fixed: No personal data is collected from minors; work produced with AI is disclosed; a human approves the result.

AI-content labelling and accessibility

Rules for labelling generated content and for accessibility depend on the audience, the medium and the applicable law. Accessibility requirements must be stated explicitly, not assumed.

Fixed: Generated output is disclosed where required; accessibility is a requirement, not an optional flag.

Organization type

For-profit, non-profit, cooperative and public bodies have different procurement, transparency and audit duties.

Fixed: The same evidence rules apply to every organization type.

Platform intermediaries

App stores, payment providers, cloud providers and ad networks impose their own terms that can block a feature regardless of local law.

Fixed: Intermediary terms are treated as hard constraints, not as advice.

Choosing a model through the axes (v3)

The axes describe the task. A model is choosable only when its route declares the same facts about itself: choice is a match between the task profile and the model profile, and every exclusion has a reason code.

declared, not enforced This is v3 policy. The gateway does not apply these filters automatically yet; until it does, the user picks the model and an unknown route fails with an error code.

Model profile — the other half of the filter

FieldValuesWhy
provider_jurisdictionEU, US, UK, CN, otherMatched against sanctions, export control and the user’s data jurisdiction.
hosting_regionEU, US, UK, other, unknownMatched against storage_region; unknown is treated as not matching.
retention_and_trainingno_retention, retention_declared, trains_on_inputs, unknownDecides whether personal or confidential input may reach this route at all.
license_termsopen_weights, proprietary_api, output_restrictedMatched against licenses_ip and the client’s distribution model.
fallback_policynone, declared_same_model, declared_other_modelA route that may swap the model is shown as such before the task starts.
measured_ontask_class + receipts, not_measuredQuality is a claim per task class with receipts, not a general ranking.
price_basisper_accepted_result, per_token_onlyCheaper failures must not look like savings; cost is compared per accepted result.
content_policystrict, standard, permissiveA permissive (low-refusal) route is for fiction and ideation only: adult account, explicit opt-in, labelled output, no tools and no actions. Prohibited uses stay refused on every route.

Precedence when axes conflict

  1. Law, sanctions and export control.
  2. Safety invariants of this page.
  3. Sector rules.
  4. Organization policy of the client.
  5. User preference.
  6. Price and speed.

An unknown value is treated as the most restrictive value of that field, never as a default. An unknown jurisdiction blocks egress of personal data; an unknown retention policy blocks confidential input. Every hard-filter value carries a source date and a review date; an expired value counts as unknown. If hard filters leave no candidate, a person decides; the safe default is no model.

Filters by audience

WhoHardRankingNever
StudentAge and digital literacy; personal data never leaves; no paid route without an adult or teacher.Explanation quality in the student’s language.Auto-apply changes or submit work as the student’s own.
Solo developerLicenses and secret egress.Cost per accepted result, then speed; escalation to a stronger model only with a reason code.A silent switch to another model.
Team or enterprise developerData jurisdiction, storage region, provider retention, sector rules and organization policy.Measured quality on the team’s own task classes.An unpinned model or a fallback that was not declared.
Decision-maker (manager, investor)Lines from at least two independent vendors, with receipts and stated disagreements.Brevity: options, the safe default and what each option costs.A model deciding on money, public claims or priority.
Fiction and worldbuilding (for example, a starship for Centavra)Adult account and explicit opt-in for a permissive route; prohibited uses refused on every route; no tools, deploys or money.Range of imagination; a strict and a permissive line may be shown side by side for people to compare.Moving permissive output into code, actions or published facts without a strict-route review and a person’s decision.

Claim ladder

  1. 1. HypothesisStated before any measurement; may be shown only as an idea.
  2. 2. Internal measurementThresholds were written down before the run; the run is isolated and every attempt has a receipt.
  3. 3. Independent verificationA separate judge re-checks the receipts and the isolation and accepts or rejects the run.
  4. 4. Public claimOnly now, scoped to the measured task class, with failures published next to successes.

Rule-pack savings are at step 1. Two benchmark runs exist; neither was accepted by the independent judge. Rule packs remain a convenience preset; we make no claims about savings.

NIST AI RMF map: what we have and what is missing

Self-assessment against the four functions of the NIST AI Risk Management Framework 1.0. Every row is partially covered.

FunctionHaveMissing or partial
GOVERNDeclared policy with revisions, invariants, a person deciding on money and public claims.A register of AI systems and model versions; a decommissioning procedure.
MAPAxes, lifecycle dimensions, profile fields, filters by audience.An impact assessment per task class; a register of third parties (providers, libraries, data).
MEASUREDeterministic checks, a receipt per attempt, an independent judge.Drift detection when a provider updates a model; checks that the metrics themselves work.
MANAGEFail-closed budgets, no silent fallback, stop conditions, “does not prove” stated per check.An incident register and rehearsed rollback.

Risk is judged per action, not per tool: the same command is harmless in a sandbox and critical in production. If a risk is unacceptable — money that cannot be returned, harm to people, an irreversible action — the work stops; it is not “reduced to acceptable”.

Lifecycle dimensions (v2)

This second layer describes how the agent acts, not only under which conditions. Added after the Astra review.

DimensionQuestionExampleCheck
intent_outcomeWhat is the task, the accepted result and the excluded scenarios?Fix the failing test without editing the test.Acceptance criterion written before the run; without it — NOT_RUN.
authorityRead, prepare or execute; which tools; who approves; may it delegate?The agent prepares a diff; a human presses Apply.A tool outside the allowlist is refused.
impactSeverity, scope, reversibility, detectability, time to intervene?A production edit is reversible; a money transfer is not.Irreversible actions require explicit confirmation.
runtimeCloud, on-premise or edge; CPU, memory, network, latency, availability?A local model for autocomplete, a server model for refactoring.Latency and memory measured and stored with the profile.
data_qualityOrigin, rights, freshness, quality, evidential support, uncertainty?An answer about the documentation of version X, not “in general”.Every source carries a link and a date.
lifecycleMonitoring, incidents, rollback, model updates, migrations, retirement?A model change does not break stored tasks.Rollback test and compatibility test pass.
human_capacityAge, digital literacy, cognitive load, interaction modes, accessibility?A 7th grader gets short steps and an adult nearby.Readability and accessibility check recorded.
accountabilityWho owns the decision, who approves, how are conflicts resolved, who revises the policy?The risk owner decides “fast vs safe”.Every rule has an owner and a version.
economicsCost per accepted result, retry and concurrency limits, cost/quality/time trade-offs?An expensive model only for complex tasks.A receipt per attempt; unknown spend is not zero.

Profile fields

FieldValuesWhy
operator_jurisdictionEU, US-CA, US-TX, UK, BR, IN, RU, CN, other
The list is extensible; “other” requires a named jurisdiction.
Selects the rules that bind the party operating the service.
user_jurisdictionEU, US-CA, US-TX, UK, BR, IN, RU, CN, other
Not merged with the operator: they can differ.
Selects consumer, privacy and content rules that bind the user.
storage_regionsame_as_operator, EU, US, UK, BR, IN, otherDeclares where data is stored and processed.
sectorsoftware, finance, health, education, public_sector, mediaAdds sector obligations and evidence requirements.
risk_profileconservative, moderate, aggressiveCaps what the agent may do with money and markets.
visibilitypublic, internal, confidentialWho may see the inputs and outputs.
contains_personal_datatrue, falseSeparate flag: internal data can still be personal.
sensitivitynormal, sensitive, special_categorySeparate flag: sensitivity is not the same as visibility.
languageen, ru, uk, hi, otherControls localization, formality and disclosure language.
intermediarynone, app_store, payment_provider, cloud, ad_networkNames the platform whose terms can block a feature.
organization_typefor_profit, non_profit, cooperative, public_bodyProcurement, transparency and audit duties differ.
accessibility_needsnone, vision, hearing, cognitive, motorTurns “accessibility” from a slogan into a requirement.
license_allowMIT, Apache-2.0, BSD, proprietary-internalDefines what may enter the codebase.
prohibited_useweapons, surveillance, sanctions_evasion, disinformationRefused regardless of jurisdiction.

Invariants and guarantee status

  1. Factual claims carry a source. Versions, identifiers and our own measurements follow their own rules.confirmed by checkClaims without a source are flagged; version numbers and policy ids are excluded from the rule.
  2. Destructive commands and writes outside the workspace are refused.confirmed by checkEvery command passes the blocklist; one match fails.
  3. Each task declares operator and user jurisdiction whose rules apply.partially coveredMissing jurisdiction is NOT_RUN, never PASS.
  4. Budget is reserved before a task starts and recorded after it ends.confirmed by checkEvery attempt has a reservation row and a receipt; a missing row fails.
  5. Personal data is not sent to a provider or written to logs, prompts or published pages.partially coveredPII check runs before egress to the provider and before tool execution, plus a scan of diffs and output.
  6. Protected attributes are not used to rank, price or refuse service.partially coveredSearch profiles and policies for protected-attribute fields.
  7. Weapons, surveillance, sanctions evasion and disinformation are refused.partially coveredUse case checked against the declared prohibited set.
  8. Every page states what the product does not do and where the law overrides this policy.confirmed by checkRequired disclosure block present on the page.
  9. If a model or route is unavailable, the task fails with a code; it is not silently replaced.confirmed by checkUnknown route returns an error code, not another model’s answer.

“Partially covered” means the check exists but does not see the whole data path or every action.

Checks

CheckPASSFAILDoes not prove
pii_before_egressNo PII leaves before the provider call or tool execution.A PII pattern is found in the outgoing request.That the provider does not retain data under its own policy.
pii_scanNo PII patterns in diff or output.At least one pattern matches.That no personal data reached the provider.
license_allowlistEvery new dependency is on the allowlist.An unknown or unclear license is present.That the license fits the client’s business model.
sanctions_screenCustomer and use case are not on the list.A match is found.That the end use is lawful in every jurisdiction.
path_allowlistEvery edit is inside declared paths.An edit touches any other path.That the edit is correct.
secret_scanNo key-like strings in diff or output.A candidate secret is found.That no secret was sent to a model.
policy_presentPolicy id, revision and disclosure are visible.Any of them is missing.That the policy is followed.
sourced_claimsEvery factual claim has a link; versions and ids are exempt.A factual claim without a source is present.That the source is correct.

Segmentation risks

RiskEarly signal
One worldview becomes the default for every client.A profile field named party or religion appears, or one profile becomes the default for all.
Users see only confirming material.The share of a single source in answers rises for several weeks.
Complaints about censorship and about discrimination arrive at the same time.Two complaints from opposite sides within one month.
Every client gets a private variant.Profiles grow faster than paying clients.
The product is described by a group, not by a function.External mentions lead with an audience label instead of the task.

What we do not do

  • No party or religion packs.
  • No hidden value choice behind the word neutral.
  • No free-text list of forbidden topics: only a versioned policy id.
  • No word-list test as proof of neutrality.
  • No compliance claim that is not backed by a declared check.

This is a declared policy for Tvijo agent profiles, not legal advice. The applicable law depends on the jurisdictions named in the profile and can override any statement here. Revision v2 applied the independent Astra review; revision v3 applies the Opus 5.5 review. Model lines are quoted advice from the named models, not votes and not evidence; where a line was not asked a question, it says so. Numbers without a source are not published.