Shared Oxygen

inDoc

Investigation Over Restricted Libraries

The Closed Drawer Never Opened. The Open Files Have Citations.

inDoc puts an agent on the library. The model chooses the next move — search, read, compare — and stays in the loop until the brief can name its sources, or the steps run out. Tools only open files the signed-in role is allowed to see.

The run is still there after the answer. The model can stay on the operator's machines.

Request A Live RunArchitecture Review
THE AGENT WORKS THE LIBRARYLIBRARYIndexed FilesKeywordVectorRole-ScopedINDOC COREThe Model ChoosesPlanReviseBudget Cap OnCITED BRIEFAnswer + LedgerSourceTraceSources NamedACCESS LINERBAC · ABAC · Tool-Bound · Not A Prompt RuleSCANOCREMBEDINDEXCONTROLSJWT · MFAField EncryptSIEM ExportHIPAA ModePCI Mode
The Library · The Loop · The Brief With Sources

The Loop

Search Hands Back Snippets. The Agent Keeps Working.

A wrong first hit gets a different search. A promising file gets read. Two versions get compared. The run ends when the brief can stand, or when the budget is gone. Either way the path is sitting there.

THE MODEL PICKS THE NEXT MOVEPLANACTOBSERVEinDocTOOL CATALOGLISTSurvey ScopeSEARCHHybrid RetrieveREADExtract FactSUMCondenseCMPDiff SourcesFINISHCite And CloseSTEP BUDGETExhausted → Finish Or Stop
Plan, Act, Observe — Until The Answer Or The Budget

The Line

Access Is Enforced In The Tool. Not In The Prompt.

Search, read, summarize, and compare only resolve files the signed-in role may touch. A closed contract does not appear in results, does not get summarized, and cannot be cited. A prompt cannot talk the agent past that.

SCOPE IS APPLIED AT THE TOOLTHE ROLEAuthenticatedRole · AttributeJWT · MFAGATERBAC · ABACSame Set As The RestIN SCOPESearch · Read · Summarize · CompareObservable · CitableOUT OF SCOPENever Listed · Never ReadHold · No ObservationLEDGERthought → tool → observation → citation · each step retainedAUDIT READY
The Role's Files Only. The Rest Do Not Appear.

After The Answer

The Brief Leaves. The Path Does Not.

Both Indexes Vote

Keyword and meaning, scored together. The hit feeds the next move. The hit is not the deliverable.

Models On The Iron

Local inference is the working path. A public API is a fallback switch, not the architecture.

Clean Before Queryable

Scan, extract, embed, write both indexes. Until that finishes, the file is not in play.

The Path Stays

Thought, tool, result, citation — kept. An answer with no path does not ship.

Who Lives With This

The Brief Has To Survive Counsel And The Desk.

For The Risk Owner

  • The brief names documents. Floating prose does not leave the room
  • The agent cannot reach what the role cannot reach. That is code
  • Counsel can open the run and see how the number was found

For The Operating Desk

  • State the objective. Watch the loop. Take the brief
  • Index the library once. Query it in place
  • Out of scope holds. It does not leak
LegalHealthcareFinanceInsuranceRecordsDiligence

Limits

Counsel still owns the legal call. The records officer still owns the file.
Models miss. The ledger is how that gets found.
The working inference path is local. Cloud is a switch, not the default.

On The Screen

What Has To Happen In The Room

A live run against a real library, or a stand-in

A file the role cannot see — and the agent missing it

The ledger after the brief lands

Where the model sits, and what never leaves the room

Bring One Library And One Hard Question

The session covers the files, who can see them, and where the model is allowed to run. A mismatch gets named in the room.

Request A Live Run

inDoc is a product of Shared Oxygen, LLC