Kill switch
A kill switch blocks AI serving regardless of system state. The drill is part of deployment — on the record before go-live.
Backup and restore
Encrypted backups with verified restore drills, preserving audit-chain continuity across recovery.
Rollback
Knowledge packs, model configurations and baselines all version; each can roll back to the previous approved state with the change recorded.
Fail-closed gates
Go-live and permission decisions fail closed: a blocked gate never reads as passed, and uncertain access mappings deny until reviewed.
These are architecture and control descriptions, not audit results. Current assurance status — implemented, tested, planned — is summarised in the Security & Trust Centre, and deeper material is available through the security architecture pack.