Boundaries and limitations¶
The value of AI IT House depends on making its assurance boundary explicit. This page lists the most important limits of the current implementation.
Human accountability remains external¶
AI IT House can structure analysis, artefacts, reviews, escalation and authority boundaries. It does not become the legal, risk, architecture or business authority.
L0 Human Authority is deliberately external to the six JAI layers.
Structural eligibility is not arbitrary truth¶
The runtime can check whether required records, reviews, evidence relationships, authority and freshness conditions are present under an encoded policy. It cannot infer that arbitrary natural-language claims are true merely because a traceability graph is complete.
Bad requirements, bad observations or mistaken expert judgements can still produce a structurally coherent record.
Layered engagements are not globally mandatory by construction¶
The JAI core is normative, and /layered provides strong supervised execution once opened. However, direct role/workflow paths remain available and the current role-router does not deterministically force every consequential task into a layered Fabric engagement.
Deployments requiring that property must add an entry-routing/enforcement control.
Managed hooks are not a complete sandbox¶
The authority hook blocks/asks for common authority acts and protects Fabric/findings records on the ordinary path. Its own implementation explicitly describes this as a string-level guard rather than a sandbox against a determined adversary with unrestricted shell access.
Use host/container/identity controls when the threat model requires stronger non-bypassability.
Layer 6 write isolation is partly host-dependent¶
L6 has no normal Write/Edit tool in the provider agent definition. Preventing every possible write through a shell ultimately depends on the surrounding execution/sandbox policy; a read-only mount is stronger than an instruction alone.
Provider behavior remains a dependency¶
The package tests adapter contracts, authority behavior and provider parity. It does not control provider availability, hidden provider context handling or all future provider/model changes.
The context digest proves that a result is bound to the intended rendered packet; it does not cryptographically prove what additional context a third-party provider may have supplied internally.
Behavioral Gate G is not a live-model certificate¶
Packaged reference results are fixtures. Gate G PASS qualifies the harness/corpus/threshold/evaluator combination. The release explicitly makes no provider/model claim without live captured result evidence.
No Prolog execution in the current implementation¶
The research article uses Prolog notation to make selected symbolic decisions inspectable. The current runtime implements its operational supervision path in deterministic Python and finite policy/state transitions; it does not embed or execute Prolog.
Human approval is not proof of technical truth¶
A human authority may accept a defined residual risk or permitted use. That decision does not convert incorrect evidence into a fact. Evidence qualification and authority are separate.
External side effects require deployment-specific controls¶
A local release decision cannot make arbitrary external APIs transactional. Target-side concurrency control, idempotency and reconciliation remain necessary for consequential remote actions.
Publication integrity is scoped to the projection contract¶
A valid ProjectionManifest can show that the audience artefact matches its required publication projection. It does not prove that the upstream semantic content was substantively correct.
Historical evidence can become unavailable¶
Hashes preserve identity/integrity relationships, not deleted source content. Retention, privacy and evidence-access policy determine how much later reconstruction remains possible.