Control that survives contact with a real organisation.

Sensitivity is a property of the information itself, not of the folder it happens to sit in. It travels with the value.

Sensitive information stays protected wherever it turns up — in a list, in a search, in a report, on its way out of the building. No one has to remember to protect it, and no one can forget.

Access is decided per cell — one field of one record — not per screen. Two people can hold the same file; one of them holds it redacted.

The same record can be open to one person and withheld from another, down to the single detail that separates them. Everyone works from one picture, and no one sees past their own entitlement.

Every change is attributable, and the state a decision was made against can be reconstructed afterwards.

Years later, the institution can still say who changed what, on whose authority, and what was known at the moment it was decided. That account is never assembled after the fact.

Changes that matter can require a second person before they take effect — and the wait is part of the operation, not a convention people observe when there is time.

The institution decides which changes are too consequential for one person, and that judgement holds even when everybody is in a hurry. The request, the decision, and the reason stay with the change itself.

What Gothem learns about your institution, it learns from your institution and no other. Nothing you teach it is ever put to work for anyone else.

What Gothem knows about your institution was learned from your institution’s own history. Nothing about you is pooled, shared, or put to work for anyone else — so what you learn stays your advantage.

Machines may propose objectives and plans. Only a person can activate one. Intelligence advises; authority decides.

Software can recommend what to pursue and how to pursue it. Whether it is worth pursuing stays a person’s decision, and the latitude a machine is given extends only as far as it has earned.