Put intelligence to work. Keep authority with the institution.
Indwel gives consequential AI one governed operating architecture. The Cognitive Executive and Cognition Kernel conduct governed thinking while information, Evidence, authority, Work, capability, and consequence remain distinct and attributable. Models, providers, agents, and infrastructure can change without becoming the institution’s source of truth or authority.
The machinery of Sovereign Cognition
Enterprise technology is usually commissioned in the language of business, yet the undertaking is gradually translated into technical objects: cases become workflow states, decisions become database records, and policies become application logic. Over time, the people accountable for the outcome can find themselves adapting their judgment to the constraints of the systems meant to support it.
AI raises the stakes because the abstraction can now interpret information and Evidence, choose among alternatives, invoke tools, and participate in consequential Work. Organizations that moved quickly from copilots to retrieval and agents have discovered that intelligence can spread faster than the institutional machinery needed to govern it; organizations that hesitated have often been waiting for precisely that machinery. The architectural question is no longer whether a model can help. It is whether cognition can enter real Work without dissolving the boundaries by which the enterprise assigns authority, establishes Evidence, controls action, and proves outcome.
Indwel makes cognition the operating system, not an ungoverned feature inside another workflow. The Cognitive Executive directs the undertaking while the Cognition Kernel executes its governed phases. Work preserves durable objectives and obligations; Sovereign Collections establish the information domain on which thinking may rely. Institutional authority remains with the institution, and consequential action remains accountable to it.
See how Work persists across systems, participants, and time →
The architecture of Sovereign Cognition
The Cognitive Executive and Cognition Kernel power governed thinking across Indwel OS
Set conditions throughout Indwel OS
Living offices for coaching, review, and delegated decisions
Constitutional Orientation
Cognition
Sovereign Collections
Simple Collections and structured or semantic Collections share one governing contract
Governed Action within Indwel OS
Routes authorized operations
The architecture of Sovereign Cognition
The Cognitive Executive and Cognition Kernel carry the governed work of thinking across information, action, and time
Indwel OS
Govern the behavior and capabilities of the entire operating system
Living constitutional offices coach, review, and adjudicate delegated transitions
Constitutional Orientation
Meaning and executable authorityCognition
Explore inferenceDirects reasoning, investigation, and continuation
Executes governed thinking and coordinates capabilities
Sovereign Collections
Constitutes the governed information domain for selection and Evidence
Governs the domain, its native units, selection, and Evidence requirements
Supplies Collections or supports governed live access
Documents and files constituted as a governed Collection
Defined information units support precise selection and semantic retrieval
Selects exact units or relevant material under the Collection Contract
Continuity and Proof
Operating Foundation
Governed Action
Routes authorized capability requests
Records observed Effects for Settlement
Enterprise applications and services
Governing scope
Constitutional Authority
Scope and reserved human decisions
Engagement paths
Conversation and Work
Interfaces and durable work
Governed response
Durable obligations and continuation
Constitutional interpretation
Constitutional Orientation
Related functions, not a mandatory pipeline
Execution and control
Cognitive Machinery
Execution, faculties and answer admission
Information exchange
Collections and Evidence
Two ways to obtain information; one Evidence gate
Consequential exchange
Action and Settlement
External effects are observed, never assumed
Applications, data services, and operational capabilities
Inside Indwel OS
Outside Indwel OS
Enterprise CapabilitiesApplications, data services, and operational capabilities
Durable truth
Continuity and Proof
Canonical truth and different continuity responsibilities
Operating planes
Enterprise Operating Foundation
Tenant authority, protected operations, and resource economics
Diagram key
Select an architectural component to read its definition and relationships in a focused detail view
Explore canonical concepts and control correspondences
Browse design-level correspondences between Cognitive Canon concepts and native controls. These are not component-specific mappings or claims of control implementation or effectiveness. The published Control Inspector may use a different editorial title for the same native control ID.
Select a concept to inspect its source-defined control correspondences.
Cognitive Canon–Compliance assurance bridge (August 30, 2026); native control catalogue (September 7, 2026). Correspondences remain design-level candidates.
Indwel absorbs the technical translation without forcing the enterprise to redesign the work around AI.
Govern the handoffs, not just the model.
The development of enterprise AI has produced valuable capabilities at different layers. Copilots have made models useful in daily work, retrieval-augmented generation has connected them to enterprise information, and guardrails and gateways have improved output control and provider choice. Agents have brought tools and delegated execution into reach, while workflow and observability have made the resulting activity easier to coordinate and inspect. Each advances an important part of the system, but the handoffs between them still need a common account of authority.
The unresolved risk appears at the handoffs between those layers. A sound retrieval system can still pass material into inference without establishing its standing. A capable agent can still possess technical reach without institutional permission. A successful tool call can still be mistaken for the business outcome it was meant to produce. Application logs can still show what software attempted without establishing what the institution is prepared to treat as true.
Indwel governs those transitions as part of one attributable act. Probabilistic intelligence can interpret, compare, plan, and recommend, but it cannot grant itself authority at a seam or decide that the conditions for a consequential transition have been satisfied. The undertaking remains coherent even when the models, retrieval systems, agents, applications, and infrastructure participating in it change.
Information architecture
RAG is one retrieval mode inside a larger Evidence architecture.
Indwel supports embeddings, vector and semantic search, structured filters, hybrid retrieval, contextual grounding, and synthesis over retrieved material. Those mechanisms sit inside the broader Collections architecture that preserves the semantics and obligations of the information domain.
Retrieval is only the beginning of the enterprise evidence problem, because a relevant result may still lack the provenance, rights, completeness, currency, applicability, or sufficiency required for the decision at hand.
Collections describe meaningful units, structure, selectors, exact and bounded scopes, semantic retrieval, source custody, ordering, completeness, interpretation rules, and proof obligations. Where natural language must be translated into structured acquisition, the Semantic Acquisition Compiler can propose Collection, selector, scope, and operation candidates. It cannot answer, retrieve, admit Evidence, or invent capabilities; the Sovereign Collection Contract validates what may execute. Where scope is determinate, the expected result can be established before retrieval begins. Where relevance is genuinely probabilistic, semantic retrieval remains available.
Collections govern the information domain before inference begins.
A Collection is not merely a corpus, index, vector store, or connector target. Its Sovereign Collection Contract states what the Collection means, which selectors and selector families are valid, which sources and versions are in scope, how exact and semantic retrieval behave, what ordering or completeness can be known, which rights and policies apply, and what proof the result must carry. That makes the information domain independently governable instead of asking a model to infer the rules of retrieval from prose or context.
The same Sovereign Collection Contract can support simple deterministic Collections, richly structured enterprise Collections, semantic Collections, or hybrid forms without changing the governing principle. The enterprise can know when a result set is complete, when it is only relevant, when a source is authoritative for one proposition but not another, and when additional acquisition is required. Collection governance is therefore upstream of model choice: the institution determines the admissible information universe before probabilistic inference is allowed to reason over it.
Simple Collections bring that same sovereignty to ordinary business work. A user can gather one or more PDFs, Office documents, reports, exports, or other supported files into a named Collection, qualify their source and custody, and immediately use that bounded information domain through normal Indwel cognition. “Simple” describes the authoring experience, not a weaker governance path: selector scope, provenance, rights, Evidence admission, citations, lifecycle, security, and retrieval behavior remain governed by the same Sovereign Collection Contract as richer enterprise Collections. A team can therefore begin with “these are the documents for this undertaking” without giving up the architecture it will need when that Collection later becomes shared, structured, automated, or integrated with systems of record.
The design preference is objective before probability: use deterministic or provable mechanisms where the problem permits them, and reserve probabilistic methods for the work that needs them.
One retrieval mode among deterministic, structured, semantic, hybrid, bounded, aggregate, and source-directed retrieval.
Used where probabilistic relevance is appropriate, not substituted for an exact scope the system can enumerate.
Measured against expected units, source identity, integrity, ordering, and coverage where the Sovereign Collection Contract makes those facts knowable.
Candidate information becomes usable as Evidence only after admission and sufficiency are established.
The Evidence Firewall controls what the system may rely on.
Information arrives from Collections, databases, connectors, agents, uploaded files, APIs, and external sources. None of those channels can declare its own output authoritative. The Evidence Firewall applies source, provenance, policy, rights, content, integrity, completeness, and admissibility requirements before material is allowed to govern cognition.
That gives data, risk, and line-of-business teams a common operating distinction: access to information is not the same as authority to rely on it.
Inference architecture
Models remain replaceable. Institutional authority does not.
Indwel assigns models to cognitive roles rather than building the institution around a provider. Interpretation, extraction, planning, research, reasoning, verification, synthesis, code, and multimodal work can use different faculties while the governing architecture remains stable. Frontier, specialist, private, local, and air-gapped inference can occupy different roles without becoming different systems of authority.
Selection can account for capability, quality, cost, latency, provider, deployment boundary, data-egress policy, retention posture, and the authority under which the work is taking place. A model may be approved for one role and prohibited for another. Technology leadership can change the model portfolio without rewriting the institution around it.
That separation turns model choice into a governed operating decision rather than an architectural dependency. An enterprise can use a frontier model where its capability is justified, a specialist model for a bounded task, private or local inference for sensitive Work, and a different provider when cost, availability, jurisdiction, or risk changes—while the same rules for Evidence, authority, continuity, and proof remain in force.
The Cognition Kernel is the execution spine beneath those choices. It plans and routes Work, invokes models and governed capabilities, accounts for budgets, evaluates Evidence and sufficiency, permits bounded repair or re-entry, and controls synthesis and terminal disposition. Models contribute cognition inside that run; they do not control the run itself.
The Inference Firewall
Probabilistic intelligence operates inside a pluggable, configurable boundary that determines the Evidence available to it, the scope of reasoning, reachable capabilities, support requirements for claims, uncertainty that must remain explicit, and the transitions available when governing conditions are satisfied.
Models remain interchangeable faculties of Sovereign Cognition. The Inference Firewall keeps the authority outside them, so the model can change without changing the law around it.
Cognitive Contracts govern how authority applies during execution.
Authority resolves from organizational and team policy through durable Work, source and Collection requirements, and turn-specific conditions. The resulting Cognitive Contract governs Evidence obligations, permissible models, available capabilities, budgets, approvals, escalation, retention, and consequential action. No run proceeds without an explicit governing contract.
For security, risk, and business owners, this is the practical distinction between documented policy and enforceable policy: the rule reaches the run before the output reaches the business. Human participation can therefore be required at explicit decision gates, with machine inference supplying analysis without acquiring the authority reserved to the accountable role.
Cognitive Governors bring institutional disciplines into living Work.
A Cognitive Governor is a living, bounded constitutional office that participates in Work under the applicable Cognitive Contract. A Coach brings an institutional discipline into the undertaking while it is taking shape. A Reviewer produces an attributable assessment against the effective standard. A Transition Governor adjudicates a defined consequential boundary under delegated jurisdiction. These offices may work together, but a recommendation is not a binding disposition, and permission to advance is not authority to execute the transition.
Institutions can constitute Governor packages from their own policies, professional standards, methodologies, and approved interpretations. Each Governor carries an identifiable scope, governing corpus, and version. Multiple Governors can participate in one undertaking without turning their distinct offices into a vote or allowing one to override another's binding jurisdiction. Their interventions and material dispositions remain attributable in the Work's durable record.
Cognitive Contracts govern the whole system, not merely the Governor offices. They can determine information requirements, cognitive behavior, model and capability use, budgets, delegation, required participation, retention, and conditions for action or Settlement. Firewalls, execution controls and commit authority retain their own responsibilities. Governors bring active institutional judgment into that larger constitutional order; they neither replace the kernel nor acquire sovereignty over it.
The interrogatory function makes missing authority and knowledge explicit.
A business undertaking cannot always move forward through another retrieval or model call. A material fact may be known only to a particular person, while an exception, approval, attestation, preference, or consequential judgment may belong to an accountable office. Indwel can seek that contribution from the person entitled to supply it, keeping the resulting answer and its authority within the governed Work rather than treating the exchange as an interruption.
The question itself is governed. Work and the current Cognitive Contract determine why the question is being asked, what may be disclosed in asking it, who is entitled to answer, whether the response is Evidence, instruction, preference, or authorization, how long it remains applicable, and what transition it can unlock. Human and machine participants can therefore contribute to the same inferential task without collapsing their different authorities into a single conversational voice.
When the Work lacks a fact, judgment, or authority that only a competent person can supply, Indwel can ask for it. That question is a constitutional part of the undertaking, not an informal conversational fallback. A deficit in Evidence, judgment, authority, or the resolution of conflicting claims may make further inference unwarranted, and Cognitive Governors can require the appropriate contribution rather than rewarding fluency over truth. The response becomes part of the Work, much as a question from an analyst to a manager or an engineer to security forms part of ordinary organizational practice, and cognition resumes under the standing and authority that contribution actually possesses.
Capability architecture
Tools, agents, connectors, and Fieldwork share one governed execution model.
Technical reach is not institutional permission. Tools, deterministic functions, enterprise adapters, connectors, governed agents, and Fieldwork enter Indwel through execution paths that resolve identity, tenancy, policy, capability scope, budgets, runtime and request ceilings, data boundaries, and other limits before work begins. The same path can participate in enterprise inspection, DLP, malware and content scanning, classification, rights management, quarantine or routing, metering, and SIEM controls instead of bypassing them as agent-specific exceptions.
This distinction becomes more important as agentic systems move from producing text to changing records, sending communications, initiating payments, modifying configurations, or triggering operational processes. A capability can be technically available and still be impermissible for this principal, this Work, this Evidence state, this budget, or this moment. Indwel keeps that decision outside the model and inside the enterprise control plane.
Execution remains bounded and cancellable. Results are normalized and evaluated again before they become Evidence, support further cognition, or contribute to a consequential act. Engineering teams inherit a common control model instead of rebuilding agent and tool governance in every application.
Continuity and time
Durable state is separate from replaceable cognition.
Durable Work accumulates decisions, open questions, assumptions, observations, Evidence, derived knowledge, human interventions, rules, and changing authority. A transcript is not an adequate persistence model for that history.
Indwel treats continuity as durable state with scope, provenance, lineage, sensitivity, retention, and lifecycle. Relevant state survives sessions, can be superseded without being erased, and returns to cognition under the authority of the current Work. Work can branch, wait on people or future conditions, resume, and rejoin without becoming a new undertaking. Conversation is an interface, not the persistence boundary.
That means the same Work can move among people, models, deterministic functions, Fieldwork, external systems, and future conditions without pretending that all of those participants have the same role. Machine cognition can investigate and propose; a human can answer an interrogatory, exercise judgment, or authorize a transition; a system can report an external state; a temporal condition can reopen the undertaking. The durable Work record preserves who contributed what, under which authority, and what became admissible as a result.
That is a different problem from giving an agent more conversational Memory. Enterprise continuity must preserve which facts were known when, which authority applied, which human decisions intervened, which assumptions were superseded, which obligations remain open, and which future condition should cause the undertaking to resume. Recall is useful; institutional continuity is accountable state over time.
Time changes what Evidence can support.
Currentness, windows, recurrence, future conditions, Evidence aging, comparative periods, and temporal compatibility are part of the operating model. Two records can each be correct and still be invalid to compare. An unresolved condition can require the Work to resume later.
Temporal Operations keeps those facts explicit instead of reducing time to metadata on a record. Scheduled Work can awaken on a date, recurrence, event, deadline, or governed condition; Evidence can expire or become newly applicable; authority can change before a waiting transition resumes; comparisons can require compatible periods rather than merely available records. Temporal rules are evaluated as part of the undertaking, not left to an agent to remember.
The Chronicle preserves governed history across changes in Evidence, authority, decisions, interrogatories, human participation, and Settlement state without treating application logs as institutional memory. It is the temporal account against which the enterprise can explain not only what is true now, but what was known, permitted, asked, decided, and acted upon at the relevant time.
Infrastructure follows Work and authority.
Elastic execution handles cognition without owning durable institutional state. Relational storage serves structured authoritative state; vector and search infrastructure serve semantic and indexed retrieval; object storage preserves artifacts and source material; managed cryptography protects sensitive state; governed inference runtimes provide model execution.
Compute, retrieval, storage, and model infrastructure can evolve behind stable interfaces for Work, Evidence, authority, and proof. That gives the enterprise technical optionality without turning infrastructure change into an institutional migration.
Consequence and proof
The Sovereign Action Fabric follows the act beyond the answer.
The Sovereign Action Fabric carries authorized cognition into bounded external action while preserving the distinctions enterprise operations depend on. Recommendation, authorization, execution, external acceptance, observed Effect, reconciliation, and Settlement remain separately attributable facts. A successful API call does not establish the intended business outcome; where proof of outcome is required, the Work remains open until the relevant state is observed and reconciled.
Ordinary observability is still valuable: traces, logs, metrics, and agent histories help operators understand software behavior. Indwel adds a different question—what proposition may the institution now rely on? Settlement answers that only after the required Evidence, authority, action, observation, and reconciliation are accounted for. The result is not merely a trace of computation but an attributable institutional conclusion.
The Sovereign Run preserves one governed execution account.
The Sovereign Run records the authority applied, Evidence obligations, retrieval and acquisition, admissions and quarantines, model and capability invocations, limits, sufficiency, disposition, and consequential state. From that record, governance playback, Unity, APIs, Receipts, operator tooling, and audit surfaces project the same execution truth rather than reconstructing separate versions from application logs.
Cognitive Unit Testing makes governed cognitive behavior regression-testable before production. A test can hold constant the Work, Sovereign Collection Contract, Evidence obligations, Cognitive Contract, Cognitive Governor conditions, temporal state, human-participation requirements, capability limits, and expected terminal proposition while models, prompts, retrieval implementations, or providers change. The assertion is therefore not merely “did the model say the right thing?” but “did the governed system admit the right Evidence, ask the right question when information or authority was missing, refuse when it should, preserve required human authority, constrain action, and reach Settlement only when the required proposition was established?”
That gives engineering, risk, security, and domain owners a common assurance surface. The behaviors that matter to the institution can be exercised before production and compared after change instead of being inferred from demonstrations or sampled chat transcripts.
Security participates in the same architecture. Identity, tenancy, data rights, provider boundaries, inspection, classification, retention, quarantine, rate controls, budgets, and enterprise policy engines constrain cognition at the points where they matter.
- Identity and tenancyBind requests, data access, capabilities, and durable state to the correct enterprise principal and boundary.
- Inspection and data protectionAllow DLP, content inspection, malware scanning, classification, and rights-management controls to participate in acquisition and execution paths.
- Policy and meteringApply policy engines, rate limits, budgets, provider restrictions, and execution ceilings before resources are consumed.
- Operational securityProject receipts, governance state, quarantine, and run events into monitoring and SIEM workflows without asking those systems to reconstruct cognitive truth.
System self-knowledge
The system model is governed, too.
Indwel does not treat a marketing description of itself as architectural truth. The Cognitive Canon interprets and projects constituted system knowledge without creating authority of its own. The Canonical System Model reconciles that constituted meaning with executable reality observed by Code Authority.
That gives operators, architects, auditors, developers, and customer-facing surfaces a common basis for describing what Indwel is, what is actually deployed, and which claims are authorized. Ask Indwel and Compliance Atlas are governed projections of that reconciled authority. They can expose system knowledge, controls, and proof without becoming independent sources of operational truth or drifting away from the software and controls in force.
One architecture, different business accountabilities
Indwel keeps the operating concepts recognizable across functions: Work, Evidence, authority, capability, cost, action, outcome, Settlement, and proof. That gives each stakeholder a direct place in the operating model instead of routing every AI decision through a technical intermediary.
Change models, providers, retrieval infrastructure, and application surfaces without rebuilding institutional authority or durable state.
Build against common contracts for identity, Evidence, capability, runs, and receipts; use Cognitive Unit Testing to regression-test governed behavior instead of recreating AI control logic in every product team.
Keep identity, data movement, model boundaries, external access, capability execution, and consequential action inside enforceable controls, with the Evidence Firewall and Inference Firewall enforcing different classes of risk.
Turn evidentiary requirements, retention rules, approvals, prohibitions, and escalation paths into computational conditions rather than advisory documents.
Connect model use, Fieldwork, tools, agents, and long-running cognition to actual Work, budgets, metering, and delegated authority.
Define the undertaking and completion criteria in business terms while keeping recommendation, authorization, execution, Effect, and verified outcome distinct.
Apply role, privacy, retention, approval, and sensitive-data rules without turning workforce decisions into an AI-owned process.
Preserve structure, provenance, exactness, uncertainty, and the boundary between observation and inference while using Collections, Fieldwork, and probabilistic methods where each is appropriate.
One control model across every surface.
Unity gives people a direct operating environment for governed Work, while the Platform API makes the same underlying authority available through versioned resources for Collections, Evidence, Cognitive Contracts, Runs, Effects, Receipts, economics, and Settlement. Product API provides higher-level interaction semantics without creating an alternative authority model, and the Business App Engine composes domain applications from the same Platform resources. Whether an undertaking begins in conversation, on a schedule, through an application, or in response to an event, each surface enters the same governed operating system rather than maintaining its own account of truth.
Deployment can vary without changing the governing model. Managed, dedicated, and licensed or customer-controlled environments may place compute, storage, keys, networks, data residency, model venues—including private, local, or air-gapped inference—and operational responsibility in different hands while preserving the same rules for Evidence, inference, capability, consequence, and proof.
Keep the systems. Govern the cognition between them.
Sovereign Cognition is the operating architecture that lets an enterprise use probabilistic intelligence broadly without making that intelligence the institution's source of truth or authority. Model access, RAG, agents, workflow, guardrails, and observability remain useful; Indwel supplies the institutional layer that keeps their combined Work coherent from information through Evidence, cognition, capability, continuity, consequence, and Settlement, with authority and proof preserved throughout.