Every honest conversation about this product starts with a concession, so here's mine.
We cannot make your model deterministic. Nobody can. The moment a decision runs through a probabilistic model, the output is a sample, not a function. Same input, new temperature, a different retrieved document, a quiet version bump — and the answer moves. That's not a defect to be engineered away. It's the nature of the thing.
So when a vendor tells you they'll give you “reproducible AI decisions,” you should hear it the way you'd hear someone promising reproducible weather. They are either selling you a record and calling it a rerun, or they haven't thought about it hard enough yet.
We took the opposite vow. We don't touch generation. We make enforcement deterministic instead.
Two machines, not one
The confusion that costs teams the most is treating their workflow as one system. It's two.
There's a generation machine: the model, the prompts, the retrieval, the sampling. It's probabilistic by design, and it should be. You want it flexible. You want it to handle the case it never saw in staging.
And there's an enforcement machine: the policy that was in force, the threshold it was checked against, the autonomy boundary that decided whether the system could act or had to escalate, and the record written the instant the decision was made. None of that has to be probabilistic. All of it can be exact.
The mistake is assuming that because the first machine is non-deterministic, the second one must be too. It doesn't. You can run an unpredictable model inside a perfectly predictable frame.
You can't replay the weather. You can replay the barometer reading you wrote down at the time.
Generation · probabilistic
Run it again and it samples again. This is supposed to move.
Enforcement + record · deterministic
Same record, every replay. Byte for byte.
The point: the model is allowed to be unpredictable. The record is not.
What “deterministic” actually attaches to
Pull the verbs apart, because the marketing word deterministic gets stuck onto the wrong one.
Generation — probabilistic. We don't claim it, constrain it, or pretend to reproduce it. Run the prompt twice and you may get two answers. Fine.
Enforcement — deterministic. Given a captured context, the policy check, the threshold comparison, and the autonomy-boundary gate resolve the same way every time. There's no sampling in a >=.
Capture — deterministic. At the moment of decision we snapshot what governed it — model version, prompt, active policy version, retrieved documents, threshold, the relevant shape of the input, the outcome — as one signed artifact, not a scatter of log lines.
Replay — deterministic. We reconstruct the record. We do not rerun the model. Replaying a FoxCommand record returns the exact conditions the decision was made under, byte for byte, six months later, with the model offline.
The distinction is the whole product: we reproduce the governing conditions, never the hidden reasoning.
What we refuse to claim
This is the part most vendors skip, so we'll be loud about it.
We do not claim the model will reach the same conclusion on a rerun. We do not claim to recover the model's internal reasoning — the latents, the road not taken, the “why” inside the weights. We do not claim token-level reproducibility. And we do not quietly rerun the workflow and hand you the new answer dressed as the old one.
A rerun is a new decision wearing the old one's clothes. We said that in the last field note and we'll keep saying it, because the temptation to fake reconstruction by re-execution is exactly the trap a record exists to avoid.
We don't reproduce what the model thought. We preserve what the decision was made under. Those are different promises, and only one of them is keepable.
9 guaranteed
- Model version captured
- Active policy version captured
- Threshold checked captured
- Retrieved documents captured
- Input shape captured
- Autonomy-boundary outcome captured
- Deterministic policy / threshold enforcement
- Deterministic replay of the record
- Tamper-evident seal (hash / signature)
The point: a vendor that claims everything has thought about nothing. Here's the line, drawn on purpose.
Why this is enough
The objection writes itself: if you can't reproduce the reasoning, what good is the record?
Because almost nothing you actually need to defend lives in the reasoning. When a regulator, an auditor, or a VP asks about a decision, they are asking governing-condition questions. Which policy version was active. What threshold it was checked against. What documents the system had in front of it. Whether a human was required to sign and whether one did. What the outcome was.
Every one of those is a fact about the frame, not the sample. The frame is what we make deterministic. You don't need to re-derive the model's thought to answer “was this decision made under the policy you had approved that day, and did it respect the boundary you set?” You need the record. The record is exact.
That's the trade, stated plainly: we give up the one thing that was never recoverable — the probabilistic interior — to lock down the only thing anyone ever asks you to defend.
We're building this. The honesty is the feature.