Every claim below is one the Scout can back with receipts. The ones he can't make are listed too.
Read-Only by Design
No write path exists in the runtime. Every tool is a get, list, search, or find. The Scout does not write data, modify configuration, create segments, or send messages. This is the property the rest of the design depends on.
Recommendation, Not Execution
The output is a discovery agenda for architect review — never a scope, a quote, or anything client-facing without a human signature. The reasoning trace is fully visible, so every classification can be interrogated. The human owns the output.
Nothing Persists
Session state lives in memory and is discarded on reset. No workspace data, customer records, or response payloads are persisted beyond the active session. Trace export exists — but it is architect-initiated and visible, never background.
Everything Is Logged
Every tool call emits a structured access line: timestamp, tool, source, parameters, size, status, latency. Payloads never reach the audit tier. The access log is always on — it is the trail the whole posture depends on.
Bounded Reasoning
The loop is capped at 25 tool iterations per session; at the cap, the Scout surfaces what he has rather than riding on. Rate limits are respected by pacing calls under the platform's cap by design, not by aggressive retry.
No Credentials on Paper
Keys live in the environment, never in source or logs; error messages name the variable, not the value. Token-bearing responses are explicitly excluded from logging.
What is not claimed
"Propose, don't decide" is a workflow property, enforced in the system prompt and the review step — not a database-level write block beyond the read-only design above. And no claim is made that a malicious operator with code access couldn't rewire the agent; the posture is honest about how the system is deployed and reviewed, not armored against adversaries no agent with credentials could survive. Identified for pre-production: managed audit-log retention, broader anomaly detection, a general redaction layer.