Computed Gate — a second model has to reach the same answer before anything ships · usually read by the Chief Risk Officer
One model produced the answer, and nothing else checked it before it took effect.
A second opinion in most AI operations means the same model asked twice, or a confidence number the model produced about itself. Neither is independent, and neither survives the question an auditor eventually asks: what would have had to be true for this to be stopped? If the answer is nothing, the control does not exist.
Both outcomes of the same gate, side by side
AGREEMENT — RELEASED
- decision
- claim.coverage.determination
- predicate
- computed agreement over the derived answer — not a learned score
- model A
- vendor-a / family-1 · version pinned and recorded
- model B
- vendor-b / family-2 · version pinned and recorded
- heterogeneity
- different vendor, different family, different weights
- inputs
- hashed at derivation time, sealed with the verdict
- scope
- tenant · owner · business unit
- seal
- sha256:4f9c1a7b…e920 (illustrative)
REFUSED
The two models did not agree, so no effect was released — no payment, no decline, no letter, no downstream job.
The agreement predicate — the rule that decides whether the models agree — is computed over the derived answers, not learned from past outcomes, so it cannot be tuned into passing. A disagreement is a result, and it is written to the record with the same weight as a release. This is the behaviour that makes the gate a control rather than a label, fail-closed: nothing releases on failure.
Details for support
GATE_DISAGREEMENT
Illustrative composition, built from the components the product ships. No customer data appears anywhere on this site; the seal above is a placeholder, not a real digest. Cross-model contracts, verdicts and computed gates are observed at NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.ts and migration NCT/services/nexus-orchestrator/database/migrations/133_sentinel_core.sql — NCT is a working tree of our core, not the primary checkout, which we state rather than hide.
See it in the console
The mechanism, in three lines
Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.
First
The models have to be different
Re-derivation by a second model from the same vendor and the same family correlates its errors with the first. Heterogeneity — a different vendor, family and weights — is the property being bought, and the versions of both are pinned into the record.
Then
The predicate is computed, not learned
Agreement is evaluated by a rule over the derived answers. Nothing about it is trained on your past outcomes, so it cannot quietly learn to approve what it used to stop.
Finally
Disagreement is a result
A failed predicate releases nothing and writes the failure to the thread with its machine code. You can count refusals, argue about them, and show a regulator that the control fired.
observed at NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.tsThe element surface is deployed, and the count of elements proven live is published below as it moves.
“Proven live” means an element has been exercised against the deployed service and its verdict observed — not that a row exists in a table. All four figures are properties of our own code, observed at NCT/services/nexus-workflows/src/services/tool-executors/sentinel-executors.ts and migration 133_sentinel_core.sql.
Your numbers, in your own browser. Nothing is sent anywhere.
Get the free assessment