Three products, assembled from the same nine engines

How it works

• One essence, many implementations A unit of work is defined once and used by any number of entities without being copied. Each entity separately links it to the capabilities, processes and applications that deliver it, and keeps its own architecture landscape with baseline, transition and target states.
• Provenance before authority before a person Every fact is an assertion carrying evidence that names its source and its exact location — file, sheet and row, or section and page, or URL. Anything extracted by AI enters as inferred and rises to confirmed only when a named owner confirms it, with who and when on the record.
• Conflicts escalate rather than resolve quietly Where two sources disagree and one outranks the other, the order is applied and the rule cited. Where they carry equal authority the engine does not choose: it opens a decision record for the board that owns it.
• Intake needs two reviewers Submissions are validated, scored for completeness and confidence, and reviewed by the entity's architect and a group architect before anything becomes an assertion. Nobody approves their own answers.
• Analysis is computed, never stored Every cross-entity view is derived at the moment it is asked for. Rebuilding from the same data reproduces every figure exactly. Overlap totals count only human-confirmed matches; unconfirmed ones are shown separately as potential.

How it works

• A register is not a log A log records that a user changed a field to a value at a time. A register records that a named person or agent chose this option over those three, for this stated reason, with this much at stake, under the policy in force that morning — and later, whether it worked.
• Append-only, and policy as of the time Actions add events; nothing rewrites them. The policy version attached is the one in force when the decision was made, not the one in force when somebody later goes looking. Both are easy to skip at the start and impossible to retrofit afterwards.
• People and agents on equal footing A human decision and an agent decision are the same kind of object: same entry, same fields, same evaluation, same register. That is what lets one set of rules govern both.
• The unit is the decision class, not the department A recurring consequential decision — pricing exceptions, capital approvals, supplier awards — described once, with an accountable owner and a target time. A class is something a person, an application and an agent can each do, which is why one register serves all three.
• Reasoning recorded at the time The decider's own words, captured while the decision is being made. Reasoning supplied once the outcome is known is not reasoning; it is explanation.

Controls are mapped to the EU AI Act human-oversight requirement, ISO/IEC 42001 and the NIST AI RMF. Mapping is not certification, and Red Bear holds none.

How it works

• Six routes in, one record out Meetings and calls; a managed decision inbox; business applications read at the transaction that carries the decision; a custom connector for anything with an API; portal and mobile; and an endpoint an AI agent calls before it acts. Nothing downstream needs to know which door a decision came through.
• Intent, not aftermath, for agents The agent API registers and evaluates the decision at the moment of intent, rather than reconstructing it from logs afterwards. An agent that acts and reports later is being observed, not governed.
• Detection proposes, it never files A decision spotted in conversation or email is put to its owner, who confirms, reassigns or dismisses it. Nothing enters the register without the named decider confirming, and dismissing takes one tap and needs no reason.
• One decision, three channels, one record A decision routinely appears on a call, again in chat and again in the ERP. Identity resolution recognises the same person or agent across all three and merges the appearances into a single record with several sources attached.
• The decision, not the conversation Consent recorded before anything is taken from a recorded channel. Personal data redacted and non-decision content discarded rather than stored. Every record tagged at ingest with its residency boundary and retention class.

The design test the sheet sets itself: if an employee shown their own captured record would say it describes a decision they made and nothing else about their day, capture is working. If it reads as a transcript of their week, it will be turned off.

How it works

• Policy as code, not prose Versioned, owned by a named person, and applied to people, applications and agents alike. Each policy states what it tests and what happens when the test fails — notify, require approval, or block until it clears — and its version is recorded on every decision it touched.
• A dial per decider, in five bands From no discretion, through recommend and supervised, to delegated and autonomous. It is a setting rather than a rule, owned by the person accountable, and it can be moved without rewriting anything about risk.
• Nothing is committed without a projection Moving the control changes nothing. A proposed setting is replayed against the decisions already in that organisation's register, showing today's mix beside the mix the change would produce. Only then can it be committed, with a recorded reason.
• Tightening is frictionless; loosening is not Narrowing discretion takes effect on the author's own action. Anything that widens autonomy needs a second person to activate it.
• Agent authority, one class at a time Every agent has an identity, an accountable human owner, a defined scope and an off switch one person can reach. Its decisions can run in shadow — recorded, compared against the human's, never executed — and autonomy is extended class by class on that evidence. An agent can sit at the top band on one class, near the bottom on another and be blocked entirely on a third.

Logging what an agent did is not authority and is not a control.

How it works

• Presence is consumed, not owned Derived from declared status, calendar, working hours, time zone, device and on-call rota — each assertion carrying the time it was established. Declaring absence has to be easier than not declaring it, so the calendar is read by default and the declaration is the exception.
• A stale signal cannot quietly divert authority Past the staleness limit, presence resolves to unknown — which routes to the holder and notifies the cover, rather than guessing.
• Three named ways authority moves Standing delegation lives in the rights model. Temporary delegation is declared by the holder for a bounded period and may be narrower than their own authority but never wider. Automatic cover routes work when the holder is unavailable, bounded by that unavailability, and is reviewed one band tighter for the duration. Every decision names both parties and which mechanism applied.
• Notification is a ladder, not a channel Quiet channels first, interruptive ones at defined intervals. A notification moves from sent to delivered to acknowledged to decided, and acknowledgement is recorded only on an explicit action — one tap, never inferred from a page view. That state, not the decision, is what escalation watches.
• Escalation ends somewhere, by configuration Tiers per class with a time budget each, typically holder, cover, owner, then the accountable director. A ladder with no bound and no default is refused at configuration.

How it works

• Three ways into the library Authored in the portal; imported as a document with its structure proposed by extraction for the author to correct; or requested from Red Bear by a brief. Every pack is versioned and starts as a draft.
• Nobody approves their own Every new pack and every new version goes to a senior reviewer who approves, rejects or returns it with questions, with a recorded rationale. Until it is approved it appears in no evaluation, no match and no application.
• Ask it questions, get citations or nothing Each pack carries a question interface whose answers are drawn from the pack's own content with a citation. Where the content does not support an answer, the answer is “not found”.
• Evaluation commits nothing An approved pack evaluated against an organisation returns a proposal: where it applies, the gaps it addresses, an estimated uplift with its interval, the confidence, and what is not known.
• An application is measurable from day one Applying a pack records its version, a baseline proposed from connected data with the source and date of each figure, a start date and duration, a named owner, a named sponsor, and the predicted uplift — retained unaltered for later comparison. A baseline figure with no connected data stays a gap; it is never guessed.

How it works

• The prediction is frozen before the work starts The plan inherits the predicted uplift from the original case and retains it unaltered. Revisions keep every prior version, so the comparison is against what was actually believed at the time rather than against a later, wiser number.
• What was planned and what was done are separate records Actual implementation date, actual investment and an assessment of implementation quality, held apart from the plan. Partial or abandoned implementation is recordable, because pretending otherwise corrupts every figure downstream.
• Measured during, not at the end Revenue, margin, cash conversion and plan adherence captured periodically, each measurement carrying its period and source. Waiting until the end means the loop never closes.
• The split is always an estimate with an interval The share attributable to the intervention is separated from sector and market movement, and both halves are labelled estimates. A point figure here would be a fiction.
• Confidence decides what is shown Below a confidence threshold the product declines to attribute at all, and says why — other things moved in the same window, so this movement cannot be laid at this decision's door.

How it works

• Process and outcome never combine into one score They are held on two axes and read as a shape. Four quadrants: deserved success, bad luck, lucky escape and deserved failure. The lucky escapes are the dangerous ones, because the organisation is about to repeat the method.
• Learning has to change something What is learned must alter a person's discretion, a rule, or a standard. If it changes none of the three, it has not been learned — it has been noted.
• The expectation must predate the outcome Only works if what was expected was written down beforehand, which is why the discipline sits in the capture step months earlier rather than in the review.
• Honest about its own stage It begins as reasoning over a small number of cases with the uncertainty stated, and becomes quantitative only when the volume supports it. Saying so, rather than presenting a model trained on nine examples, is the part most products get wrong.
• Ordered by confidence, not by size Where impact is shown, the findings are ordered by how confidently they can be attributed rather than by how large the movement was. Ordering by movement would be judging by outcome, in the layout.

How it works

• The data never leaves its tenant What accumulates centrally is the pattern, not the records it was derived from. Customer data stays in the customer's own boundary.
• Queried, never copied Customers query the shared intelligence through an interface. They do not hold a copy of it, which is what makes it possible to share at all.
• Protected three ways Commercially in the agreements, architecturally by keeping it in Red Bear's own tenant separated from customer tenants, and operationally by watching for query patterns that look like somebody trying to extract the whole thing.
• Residency without surrender Where a customer requires the intelligence in their own region, a regional replica is a paid option. It remains Red Bear's data rather than becoming theirs.