ONE MANDATE, AS RECORDED · 27 JUL 2026
Two of the twenty things it did last night needed you.
“What if it goes wrong?” is the right question. Fahim runs on a platform where the guardrails are deterministic, governed by Diwan — the control plane. Diwan behaves the same way every time, independent of anything Fahim decides. Here are the two.
One of them, you said no to.
It stopped, it recorded the refusal, and it told the counterparty why. That is the part worth checking — an agent that only ever gets approved has never actually been governed.
05:58 — HELD
Refuse it yourself.
This is the card the product raises on your channel when something crosses a line you drew — not a picture of one. Both answers are legitimate and the record takes either. Declining is the one that proves the point.
Send the signed contract to Al Noor?
mail.send is provisioned for scheduling and follow-up. Contract dispatch is not in Fahim's grant, so it stops here.
THE MACHINERY
Deterministic, in seven pieces.
The guardrails don't depend on the model having a good day. Each row behaves the same way every time, whatever the model decides.
| GUARANTEE | MECHANISM | ENFORCED BY | FAILS |
|---|---|---|---|
| Identity on every action | Fahim acts under its own credentialed service principal — distinct from you and from every other agent. When it acts for you, the action carries that chain. Nothing in the ledger is anonymous. | diwan.identity | unattributed → denied |
| Capability by provisioning | If Fahim isn't provisioned for a capability it categorically cannot use it — enforcement by absence, decided in a registry Fahim cannot edit. | diwan.registry | absent → denied |
| Secrets out of reach | Credentials for your CRM, mail and calendar live on platform infrastructure, scoped and revocable — never inside Fahim's context. | platform vault | never held |
| Policy on every call | Every tool call is evaluated against version-controlled, testable policy — the same evaluation every time. Allow, deny, narrow, or escalate. | diwan.policy | engine unreachable → closed |
| Approvals that wait | Consequential moves route to you on the channel you already use. Fahim doesn't freeze — the work pauses at the gate, you decide, the work continues. | diwan.gate | waits, never assumes |
| The readable ledger | Who, what, when, with which arguments, under which decision, with what outcome. Append-only and queryable — the address of the answer when your auditor asks. | diwan.ledger | append-only |
| One-decision revocation | A governed resource answers only to a platform-issued, scoped, revocable credential. Revoke it and the resource stops answering — Fahim included. | platform credential | revoked → silent |
POSTURE
Where it runs, and who can stop it.
No badge row: we hold no certification we can point you at, and a reviewer checks. Here is the posture in sentences instead.
DEPLOYMENT
Your tenancy, in your region. Memory is owned infrastructure, not a third-party service.
KEYS
Held by the platform, never by Fahim. Scoped per capability and revocable individually.
DATA
Stays inside your deployment. Nothing is pooled across tenants and nothing trains anything.
REVOCATION
One decision, effective immediately, recorded like any other action.
Reading this for a security review? The architecture depth lives on the platform's technical page.