Nexus Governance · Model governance demo

Which AI is allowed, and why?

Every model in a governed registry carries a record: residency, risk, approved workloads, data classifications, lifecycle, and whatever evaluation is genuinely on file. The evaluator reads that record against each request and returns a deterministic verdict with reason codes. A strong evaluation score never overrides governance.

Eligibility matrix

Three requests across four synthetic models. Hover or read the reason codes: the same facts always produce the same verdict.

Request	Sovereign clinical modelSovereign · risk LOW	Sovereign general modelSovereign · risk LOW	External cloud assistantExternal · risk MEDIUM	Research red-team modelSovereign · risk HIGH
Clinical summarization of a patient chartA clinician asks for a draft discharge summary. The chart is personal health information.classification PHI · workload clinical-summarization	ALLOWELIGIBLE_OK	REVIEW REQUIREDWORKLOAD_NOT_APPROVEDEVALUATION_UNAVAILABLE	BLOCKPHI_REQUIRES_SOVEREIGN_EXECUTIONCLASSIFICATION_NOT_ALLOWED	BLOCKHIGH_RISK_RESEARCH_ONLYPUBLIC_DATA_ONLYCAPABILITY_NOT_SUPPORTED
Drafting an internal policy memoThe privacy office wants help drafting an internal memo. No patient data, but the content is internal.classification INTERNAL · workload drafting	ALLOWELIGIBLE_OK	REVIEW REQUIREDEVALUATION_UNAVAILABLE	REVIEW REQUIREDEVALUATION_UNAVAILABLEEXTERNAL_EGRESS_REVIEW	BLOCKHIGH_RISK_RESEARCH_ONLYPUBLIC_DATA_ONLYCAPABILITY_NOT_SUPPORTED
Adversarial testing on public promptsThe security team runs red-team prompts using only public material.classification PUBLIC · workload red-team	BLOCKCAPABILITY_NOT_SUPPORTED	BLOCKCAPABILITY_NOT_SUPPORTED	BLOCKCAPABILITY_NOT_SUPPORTED	ALLOWELIGIBLE_OK

ALLOW

The request may proceed with the selected model. A Trust Receipt is issued.

REVIEW REQUIRED

The request is held until a named reviewer decides. Alice calls this HOLD. Nothing is sent until the hold clears.

BLOCK

The request is refused by policy. A sovereign alternative is offered when one is eligible. The refusal itself is evidence.

Model scorecards

What the registry knows about each model. Evaluation figures are outputs of an internal suite on synthetic demo records; where nothing is on file the card says so rather than inventing a number.

Sovereign clinical model

production

DEMO-MDL-SOV-01 · Open weights · hospital hosted · v2026.06

Open-weights healthcare model served on hospital-controlled hardware. Approved for governed clinical support with clinician sign-off.

Residency: Sovereign · on-premise, Canada
Security risk: LOW
Privacy risk: LOW
Data classes: PUBLIC, INTERNAL, PHI, REGULATED
Approved: clinical-summarization · discharge-summary · governed-clinical-support · internal-analysis · drafting
Restricted: autonomous-clinical-decision
Evaluation: 93% overall · 90% hallucination resistance (internal evaluation suite · synthetic demo result)

Synthetic demo record. Evaluation figures are illustrative outputs of the internal suite, not universal accuracy.

Sovereign general model

available

DEMO-MDL-SOV-02 · Open weights · hospital hosted · v2026.05

General-purpose model on the same sovereign infrastructure. Not yet evaluated, so non-public use is held for review.

Residency: Sovereign · on-premise, Canada
Security risk: LOW
Privacy risk: LOW
Data classes: PUBLIC, INTERNAL, PHI
Approved: internal-analysis · classification · drafting
Restricted: autonomous-clinical-decision · clinical
Evaluation: Not available overall · Not available hallucination resistance (unavailable)

Synthetic demo record. No evaluation on file — the evaluator routes non-public requests to review.

External cloud assistant

available

DEMO-MDL-EXT-01 · External cloud provider · vcurrent

A commercial cloud model reached over the internet. Useful for public and internal drafting; never eligible for PHI.

Residency: External · cloud provider, outside the organization's boundary
Security risk: MEDIUM
Privacy risk: HIGH
Data classes: PUBLIC, INTERNAL
Approved: drafting · research-summary
Restricted: clinical · regulated-data
Evaluation: Not available overall · Not available hallucination resistance (unavailable)

Synthetic demo record. Egress of internal data to this provider requires a reviewer's approval.

Research red-team model

research

DEMO-MDL-RES-01 · Research build · isolated · vresearch

High-risk research model with safety training removed. Sanctioned only for adversarial testing on public data.

Residency: Sovereign · on-premise, Canada
Security risk: HIGH
Privacy risk: MEDIUM
Data classes: PUBLIC
Approved: red-team · adversarial-analysis
Restricted: production · clinical · regulated-data · publishing · tool-use
Evaluation: 71% overall · 20% hallucination resistance (internal evaluation suite · synthetic demo result)

Synthetic demo record. Renders visibly as high-risk; governance dominates its evaluation score.

Reason codes

Every verdict is explained with one or more of these deterministic codes, in plain language on the receipt.

Code	Meaning
UNKNOWN_MODEL	The requested model is not in the governed registry.
MODEL_INCOMPLETE_GOVERNANCE	The model's governance record is incomplete, so it cannot be trusted with any request.
DEPRECATED_MODEL	The model has been retired from the registry.
CLASSIFICATION_UNKNOWN	The data classification could not be determined, so the request fails closed.
PHI_REQUIRES_SOVEREIGN_EXECUTION	Personal health information may only be processed by a sovereign model running inside infrastructure the organization controls.
CLASSIFICATION_NOT_ALLOWED	The model is not approved for this data classification.
PUBLIC_DATA_ONLY	The model is approved for public data only.
HIGH_RISK_RESEARCH_ONLY	The model is high-risk and approved for sanctioned research workloads only.
WORKLOAD_RESTRICTED	This workload is explicitly restricted for the model.
CAPABILITY_NOT_SUPPORTED	The model does not support the required capability.
WORKLOAD_NOT_APPROVED	The workload is not yet on the model's approved list; a reviewer must decide.
EVALUATION_UNAVAILABLE	No internal evaluation result is on file for this model, so non-public use needs a reviewer.
EXTERNAL_EGRESS_REVIEW	Internal data would leave the organization's boundary to an external provider; a reviewer must approve the egress.
ELIGIBLE_OK	Every governance check passed.

DESIGN PRINCIPLEFail closed. An unknown model, an incomplete record, or an unknown classification is never quietly eligible. High-risk research models render visibly as such, and an evaluation score never makes a restricted model eligible. See how a verdict becomes a receipt →

← Readiness gaps Trust Center · BLOCK / REVIEW / ALLOW →

Ready to see your own organization?

Everything above is synthetic. Signing in shows your organization's own assessment, risks, policies, recommendations, and Trust Receipts. Access follows a confidential discussion and a signed NDA.

Book a 30-minute Sovereignty Review Request access

Every record on this page is synthetic and belongs to a fictional hospital. Nothing here is a customer, a patient, or a production measurement. The scoring, eligibility, and audit logic are the real Nexus engines running over the synthetic inputs.