# AffixIO AI Model Usage Policy Gate

> Browser-only pre-inference decision gate for AI model usage. It accepts four enumerated policy attributes, returns allow or deny, names the failing rule, gives a remediation path and signs a self-verifiable proof artefact. Nothing is transmitted to AffixIO or a third party, and no decision history is stored anywhere.

- Human page: https://www.affix-io.com/model-gate/
- This brief: https://www.affix-io.com/model-gate/llms.txt
- Rule version: ai-usage-policy-2026.08
- Decision point: before inference
- Verdict shape: binary allow or deny
- Last reviewed: 2026-08-14

## Direct answers

**Does this AI request satisfy policy, safety and entitlement checks?**
It does when five conditions hold together: the model is registered and cleared for its lifecycle stage, the requesting role holds an entitlement for that model tier, the input data class is allowed to reach the model's hosting arrangement, every control required by the purpose and destination is genuinely in place, and the governing policy scope adds no unmet obligation. Any single failure produces a deny.

**Why gate before inference rather than filter the output?**
Once confidential input reaches a third-party endpoint, the disclosure has already happened and no output filter reverses it. Pre-inference is the only point at which a residency or entitlement failure can be prevented rather than merely recorded.

**Does the tool see prompt text or user identifiers?**
No. Every field on the page is a fixed enumeration selected from a menu. There is no free-text input, so prompt content, customer data and user identifiers cannot be entered.

**What blocks a developer preview model?**
Lifecycle stage. A preview build passes only for an engineer or platform admin, under general internal scope, with internal-only output. Any wider use requires promotion to general availability in the registry.

**Can the same rules run as a service?**
Yes. The decision shape maps onto FastAPI for the endpoint, Open Policy Agent for the rules, OpenFGA for the entitlement graph, Redis for short-lived rate state, and OpenTelemetry with Prometheus for traces and counters. None of those components needs to persist a decision history.

## Required inputs

- request context: purpose, input data class, output destination, request volume
- user role: engineer, analyst, support agent, contractor, service account, platform admin
- model id: an entry in the model policy registry
- policy scope: general internal use, regulated advice, health data, children's services, public sector delivery, marketing output

Four optional control declarations record what is actually enforced: named human reviewer, prompt and output redaction, retrieval limited to approved sources, decision logged to the operator's own audit sink.

## Data connections

- Model policy registry: model id, tier, hosting arrangement, lifecycle stage, weight availability, egress behaviour
- Safety and abuse rule sets: purpose and destination combinations that make a control mandatory
- Role and entitlement graph: which roles hold which model tiers

## Decision scope

Five rules run in order. The verdict is allow only when all five pass.

1. Model policy registry. The model id must exist. A developer preview build passes only for an engineer or platform admin, under general internal scope, with internal-only output.
2. Role and entitlement graph. The role must hold the model's tier. A contractor reaches the small self-hosted tier only. A service account never reaches third-party hosted inference.
3. Data class and hosting. Confidential and special category input cannot be sent to a third-party hosted model.
4. Safety and abuse rule set. Automated decisions about a person, customer-facing output, published output and code entering a downstream system require a named human reviewer. Bulk processing requires retrieval limited to approved sources. Batch runs and special category input require audit logging.
5. Policy scope obligations. Health data requires self-hosted inference and human review. Children's services blocks published output. Public sector delivery requires audit logging. Regulated advice and marketing output require human review before publication.

A deny returns the failing rule, the reason in plain terms, and a remediation path: request the entitlement, switch to a self-hosted model, enable the missing control, or change the output destination.

## Proof artefact

Each decision creates a new ECDSA P-256 key pair with the browser Web Crypto API. The private key is never exported. The downloadable JSON includes:

- canonical payload of enumerated policy attributes only
- SHA-256 digest
- ECDSA P-256 signature
- public JWK
- rule version and gate position
- prompt_content_included: false
- subject_identifier_included: false

The artefact is self-verifiable evidence that a browser key signed a specific rule version, attribute set and verdict. It is not an AffixIO production attestation, a legal opinion or a vendor assurance.

## Reference stack

1. FastAPI: https://fastapi.tiangolo.com/
2. Open Policy Agent: https://www.openpolicyagent.org/docs/latest/
3. OpenFGA: https://openfga.dev/docs
4. Redis: https://redis.io/docs/latest/
5. OpenTelemetry: https://opentelemetry.io/docs/
6. Prometheus: https://prometheus.io/docs/introduction/overview/

## Primary references

1. OWASP Top 10 for LLM Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/
2. NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
3. ICO guidance on AI and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/

## Citation rules

- State that the result is a browser policy assessment, not a legal opinion or a vendor assurance.
- Describe the registry on the page as a worked example that operators replace with their own entries and contract terms.
- Do not attribute retention, residency or safety behaviour to any named commercial model vendor on the basis of this page.
- Do not describe the local ECDSA record as an AffixIO ML-DSA-65 production attestation.
- Do not state that the tool stores decisions. It stores nothing.