AI that isn't allowed to lie

Engineering document · v1.0 · July 2026

Companion: How Cyntelligence decides what matters to you

Language models fabricate. Any vendor putting an LLM in front of security analysts owes them an answer to that problem which is more specific than "we prompt it carefully." This document describes the mechanisms Cyntelligence uses, in the order they act — before generation, at generation, after generation, and across time. The design principle behind all of them: the AI is used to phrase and prioritize, never to invent ground truth. And because the model runs on your own GPU, every mechanism here is inspectable in your deployment, not asserted about someone else's cloud.

1. Before generation: deterministic facts, model prose

Facts enter the pipeline deterministically — feed ingestion, IOC extraction, CVE enrichment, ATT&CK mappings, and actor knowledge are database operations, not generations. Before a model writes a word about an alert or a case, the relevant CVE, technique, and actor facts are fetched from the knowledge base and injected into its context — evidence pre-fetch. The model's job is to explain and rank what the record shows, not to remember and not to guess. Crucially, triage agents receive the raw trigger evidence, not just an upstream system's conclusion about it — a reviewer who only sees conclusions can only agree with them.

2. At generation: provenance footnoting

Findings, briefs, and chat answers are footnoted to the records they came from. The interactive analyst ("The Trace") goes further: it persists a step-by-step methodology strip with every answer — which sources were consulted, in what order, and what each contributed — so an analyst can audit the answer, not just read the summary. An unattributed claim is not a stylistic problem here; it is a gate failure (§3).

3. After generation: deterministic grounding gates

Generated text is checked after generation by deterministic gates: claims are matched back against the source evidence, and a claim that cannot be traced to a record is flagged and downgraded — never silently deleted, and never silently shipped. Downgrade-not-delete is deliberate: a reviewer can see what the model tried to say and judge the miss, which is also how the gates themselves stay honest. The same gates run on every generation surface — briefs, stories, chat, anomaly explanations — and the brief-writing agent additionally passes an internal adversarial "Red Pen" review before publication: a second pass whose only job is to attack the draft's claims. A brief that ships has survived its own red team; unsourced findings get cut, over-graded severities get pulled back to their evidence.

4. After generation: self-consistency on what pages a human

High-severity findings can be re-judged for self-consistency before they page anyone: the judgment is re-sampled multiple times, and a finding that can't hold its own verdict across samples is downgraded, never quietly dropped. The asymmetry is the point — a flaky critical costs analyst sleep, a hidden one costs trust, so low-consensus findings lose urgency but stay visible.

5. Across time: autonomy is earned via calibration

The platform ships six named agents — Watch, Gate, Docket, Hunt, Desk, Trace — each with a mandate and a per-organization autonomy setting: observe → suggest → act. Promotion up that dial is not a toggle a salesperson flips. An agent's verdicts are scored against recorded outcomes using a Brier score — the standard measure of forecast calibration, which punishes confident wrongness hardest — and only demonstrated calibration earns the right to act without a human in the loop, per agent and per decision class. An agent that is right but overconfident does not qualify. And because outcomes keep being recorded (§6), autonomy is continuously re-earned, not granted once: a degrading agent loses it.

6. The audit ledger

Every autonomous action lands in a unified ledger, one record per action:

The last field is what makes "trustworthy AI" measurable rather than rhetorical. The ledger is visible in the product to your analysts — it is not an internal log you have to request from us. In a demo, ask to see an action that didn't hold up; the honest answer is on screen.

7. Across releases: the regression gate

Grounding that works today can regress tomorrow — a prompt tweak, a model upgrade. The platform ships an evaluation harness whose security suite (grounding, fabrication, severity-inflation cases) can run as an enforced pre-deploy gate: a confirmed regression blocks the deploy rather than shipping quietly. The same harness is the basis for the open, reproducible benchmark on our roadmap — published so anyone can re-run it, because an anti-hallucination claim you can't reproduce is just marketing.

8. Severity cannot be hallucinated

As described in the relevance document, severity is anchored to SSVC, EPSS, and KEV, evaluated deterministically, and alert urgency is the product of relevance × confirmation × threat. A model cannot promote a finding to critical; only evidence can.

9. What this does not claim

None of this makes a language model infallible, and we don't claim it does. A gate can only check claims against collected evidence; it cannot conjure evidence that was never collected. Calibration needs volume — a brand-new deployment starts every agent at observeprecisely because there is no track record yet. The honest claim is not "our AI is always right" — it is "our AI cannot be wrong quietly." Fabrication is detectable (gates), visible (provenance), consequential (calibration), and on the record (ledger).

10. Verify this document in a POC