The VSM Command Center ships into one customer's cloud account and inherits its controls. The AI runs on AWS Bedrock in that same account. No source, inference, or telemetry leaves your boundary. Each control below is claimed only where an executable test or the code itself proves it.
A lint fence, a type brand, and a database role. The agent-side connection pool is read-only, and Postgres itself rejects writes from it. No single layer is load-bearing on its own.
We retrieve a scoped, read-only credential at run time and never persist it. It is fetched from your Secrets Manager, held in memory for the clone, then dropped. It is never written to the database, logs, or config.
Clone shallow at a pinned commit, analyze, purge. What persists is the code graph and a citation: commit plus path plus symbol, a pointer into your git, never a copy. Workspaces live on tmpfs, and a boot sweep removes anything that survives a restart.
Raw spans stay in your own observability stack. The ingest listener projects each export into slice-keyed rollups and discards the spans. A canary test sweeps every table to prove nothing span-shaped survives.
Every domain write is a validated agent turn or an authorized human action, written as a decision record. Because every mutation has to produce a decision-log entry, the audit trail is complete by construction, not by discipline.
Proven, likely, or possible. Never a float. A 0.87 on an edge is false precision nobody can defend. References static analysis could not resolve are ledgered with a reason, never dropped.
Exactly five. The analysis component has zero. It runs with no network access at all. For regulated deployments this meets IL4/5 egress expectations.