AI & Data Use

1. Current authority boundary

METRAXIOM Decision Engine calculations and configured decision logic are deterministic. AI is not permitted to silently change a physical instrument identity, target/setpoint, accepted reference indication, DUT indication, measured value, tolerance, uncertainty contribution, decision rule, controlled source, reference-standard evidence, record status, human review, billing state, or authoritative outcome.

2. Six governed intelligence surfaces

Public Ask METRAXIOM is an unauthenticated educational guide. Workspace Ask METRAXIOM™ is the private workspace assistant. Interrogate™ AI answers questions about an exact retained record. Reference Intelligence™ performs separately governed candidate-source research. AI Connections is the future organization-scoped Bring Your Own AI provider path. ChatGPT/MCP exposes a read-only-first set of OAuth-authorized METRAXIOM tools to compatible external AI clients. Enabling one surface does not automatically enable any other surface.

Four AI data-flow classes. Six governed surfaces.

Public educational AI, when enabled, sends the visitor's intentionally submitted question and bounded routing/classification context to the provider identified at request time through a server-side gateway; the current adapter is OpenAI. Evidence AI includes Workspace Ask METRAXIOM and Interrogate and, only when their separate gates are enabled, receives bounded tenant-scoped evidence metadata. Research AI is Reference Intelligence and may, when enabled, reach approved external sources while producing candidate material only. Customer/external AI connections include AI Connections and OAuth/MCP clients, where the customer's selected provider or client receives only the explicitly authorized payload. These classes remain independently gated and never inherit measurement authority from one another.

3. Public Ask METRAXIOM

The public guide is held in the current public-production profile. When enabled, it is labeled AI-assisted guidance — not human approval. Before each request, the visitor must individually acknowledge that AI can be wrong, that sensitive information is prohibited, and that the question is sent to the identified provider. The server rejects a missing, incomplete, extra, or stale acknowledgment object before any provider request.

The provider payload contains question text, a deterministic question-route classification and limited public instrument-classification context. It excludes authenticated workspace data, customer source-file bodies, private measurement evidence, live device data and web-search authority. Per-request checks are not an identity-verified or retained customer-agreement receipt.

4. Ask METRAXIOM Evidence Mode

Workspace Ask METRAXIOM is an implemented private-workspace architecture and is available only through an authenticated workspace when both the private workspace and its independent assistant gate are enabled. Evidence Mode is tenant-scoped, explanatory and read-only. The server supplies selected workspace metadata rather than unrestricted database access. The initial packet excludes private source-file bodies and disables web search, calculation authority, review/release authority, team/billing administration, and silent writes.

Ask METRAXIOM is intended to identify what records exist, what evidence is missing, what a state means, and which controlled workflow should be used next. Conversation does not itself perform the controlled task.

5. Interrogate AI

Interrogate AI is an implemented private-workspace architecture and is available only through an authenticated, entitled workspace when both the private workspace and its independent feature gate are enabled. The server assembles a bounded evidence packet containing the retained run, exact bound Calibration Job context, deterministic decision, controlled input metadata, source-document metadata, physical instrument metadata, and relevant audit state needed to answer the question. The private source-file body is intentionally excluded by default.

The current OpenAI Responses adapter requests store:false and does not enable web search in Evidence Mode. Instructions require the model to answer only from the supplied retained evidence packet, identify missing evidence rather than invent it, and preserve the distinction among target/setpoint, accepted reference indication, DUT indication, candidate information, reviewed evidence, and released authority. Interrogate AI returns explanatory text only; it cannot review, release, rewrite, or approve the record.

6. Deep Interrogate orchestration

For difficult questions, METRAXIOM is designed to use controlled retrieval and deterministic tools before model synthesis—for example exact historical context retrieval, reference-standard validity evidence, calibration-history comparison, drift/statistics, uncertainty retrieval, decision-rule inspection, clearly labeled what-if simulation through deterministic code, provenance tracing, and release-readiness checks.

A separate challenge pass is intended to detect unsupported assertions, target/reference/DUT confusion, substitution of current context for bound historical context, confusion between DUT specification authority and reference-standard calibration evidence, hidden blockers, and unsupported accreditation or competence implications.

7. Reference Intelligence

Reference Intelligence may, only when its independent gate is enabled, use an approved server-side AI/search provider to locate candidate manufacturer or public metrology references by manufacturer, exact model, option, range, family, or technical description. The current OpenAI adapter requests store:false, restricts web search to METRAXIOM's governed trusted-domain registry, and records consulted-source provenance. A provider-neutral enterprise connector is also supported. Provider credentials remain server-side.

Returned and consulted URLs are constrained against the trusted-domain registry. Inclusion in that registry means eligible for discovery; it does not make every page on that domain current, applicable, licensed for reuse, or authoritative for a particular measurement.

8. AI Connections / customer-connected providers

METRAXIOM is designed so an organization may eventually connect a supported API/provider account or enterprise inference endpoint. This is not the same as handing METRAXIOM a consumer ChatGPT or Google account password, and METRAXIOM must not represent a consumer subscription as API entitlement unless the provider expressly supports that mechanism.

Customer provider credentials will remain disabled until a dedicated encrypted credential vault, AAL2 administration, tenant isolation, credential rotation/revocation, audit controls, provider verification, and data-use disclosures are implemented and tested. Provider secrets must not be retained in plaintext database columns, browser storage, analytics, audit metadata, logs, or model prompts. Disconnecting a provider cannot delete or weaken retained measurement evidence.

9. ChatGPT / MCP

The external ChatGPT/MCP architecture uses customer-authorized OAuth rather than asking a customer to give METRAXIOM a ChatGPT password or subscription credential. Requests are bound to the authenticated METRAXIOM user, allowed client/resource context, workspace membership, tenant scope, and paid entitlement before controlled data is returned.

The initial MCP tool set is read-only first: list paid workspaces, search instrument identity records, search controlled source metadata, list evidence records, retrieve an evidence record, and explain deterministic release blockers. Private source-file bodies are not returned by default. The external AI client receives only the tool output the customer intentionally authorizes; its handling of that output remains subject to the client/provider terms and enterprise configuration that apply to the customer.

10. Candidate-only human confirmation

A discovered specification remains candidate information until a human confirms the exact manufacturer/model/configuration represented by the source, original source, document revision, applicable range and environmental or operating conditions, units, and page, section, figure, table, or equivalent locator. AI-discovered information cannot silently become a controlled source, physical asset identity, measurement input, interval basis, reference-standard validity statement, or released result.

11. Authentication, entitlement and audit

Private AI-assisted capabilities require authenticated METRAXIOM workspace context and are subject to organization membership, entitlement, server-side rate controls, separate feature gates, and audit/provenance requirements. Reference discovery intentionally retains a keyed HMAC-SHA-256 digest of the normalized query in the discovery ledger rather than intentionally persisting the plain query there. If required audit provenance cannot be written, the application is designed to withhold the discovery result.

12. Customer data minimization

METRAXIOM does not send all workspace data to an AI provider merely because an AI feature is enabled. Each feature constructs the minimum task-specific payload described above. Additional AI workflows that require additional customer content must separately define what leaves METRAXIOM, why it is required, which provider receives it, which feature gate controls it, and which retention, regional-processing, confidentiality, and model-improvement terms apply.

13. Provider routing and transparency

The METRAXIOM Intelligence Gateway is designed to prefer deterministic code and controlled retrieval when an LLM is unnecessary, then route permitted AI work to an organization-connected provider, METRAXIOM-funded provider, or separately approved fallback according to the governing plan and policy. A routing decision must not silently change tenant scope, authority, or material data-use expectations. Where applicable, the provider/model class and gateway policy version should be retained with answer provenance.

14. Source rights and retrieval controls

Discovery should prefer original manufacturer, government, accreditation, standards-body, and customer-authorized material within the rights and technical-access terms that apply to each source. METRAXIOM should identify and link to the original source rather than reproduce protected manuals, standards, or databases beyond what is permitted. A domain allowlist is not a license grant. Sources requiring a subscription or restricted access should be used only through approved licensed or customer-controlled access rather than bypassed.

15. Provider retention and training assumptions

Where METRAXIOM requests store:false, that controls application-level response storage for the applicable provider API request; it should not be interpreted as a promise that no operational, abuse-prevention, security, or legally required retention can occur under provider terms. METRAXIOM does not assume ownership or training rights over customer data merely because it is processed by the service. Production provider terms, retention settings, model-improvement controls, confidentiality terms, regional-processing commitments, and subprocessor disclosures must be reviewed before broader customer content is routed externally.

16. Provenance

AI assistance that materially contributes to a controlled workflow must preserve enough provenance to distinguish gateway/policy version, provider/model assistance, consulted external sources, candidate extraction, deterministic engine execution, physical instrument identity, retained evidence, and subsequent human source confirmation. Cached answers, if introduced, must remain tenant-isolated and invalidated when controlling evidence fingerprints or policy versions change.

17. Release gate

AI functionality does not bypass metrology validation, security review, privacy/legal review, billing controls, human review, separation-of-duties controls, controlled-instrument requirements, laboratory competence, accreditation scope, or authoritative-release controls. A model response is never evidence that a calculation method, retrieved document, extracted specification, physical asset identity, reference-standard status, or calibration result is scientifically, contractually, legally, or metrologically authoritative.