Tenant scope and immutable science
Every request is bound to an organization, app, and environment. Every result is bound to immutable definition versions.Tenant hierarchy
Organization
The company and membership boundary. Roles include owner, admin, builder,
developer, analyst, and viewer.
App
One product or use case, such as Savart EFG or a customer onboarding
journey. Scores are meaningful only inside their app.
Environment
Every app has isolated test and live environments with separate subjects,
keys, programs, webhooks, quotas, and analytics.
Subject
Your app’s end user. The public ID is opaque; external identifiers and PII
live in a separate encrypted identity vault.
From definitions to results
Lifecycle rules
- Definitions move through
draft → validated → published → deprecated → archived. - Published versions never mutate; edit by creating a new draft revision.
- Live environments begin in managed review and accept mutations only after platform approval.
- Hard guardrails stay authoritative. An LLM cannot improvise questions or change scoring during an evaluation.
- Context precedence is organization → app → program → subject/session, and every merged fingerprint is stored with the result.
Credential roles
Human owners and admins publish science and activate programs.admin/ops environment keys run trusted server integrations.
ingest keys are restricted to subject import and continuous-evaluation host
writes. Participant and report tokens grant access to exactly one public
journey or report.