Vera

Microsoft Presidio runs inline with every prompt. The model reasons on redacted content; the response is deterministically unmasked on the way back. The unmask key never leaves the Vera process. Redaction is a mandatory stage in the request pipeline — you cannot configure it off, only refine what counts as sensitive.

Same request pipeline — auth → policy → QoS → dispatch → audit — regardless of upstream. The application stack does not change when the model does. The ordering is mechanized in a Lean 4 proof; the type system enforces it, so no code path — on any capability — can skip a stage.

Article 12 traceability falls out of the design; it is not a feature added on top. Chain break is detectable by any auditor holding the head hash.

{
  "principal": "svc:billing@acme",
  "route": "chat.completions",
  "model_selection": {
    "chose": "vllm-internal",
    "reason": "sovereignty:on-prem-only"
  },
  "redaction_ops": [
    { "type": "SSN", "count": 2 },
    { "type": "API_KEY", "count": 1 }
  ],
  "policy_decision": "allow",
  "prev_hash": "3f7c4d8a2e1b6f09",
  "hash": "9b21a37fe0c4d581"
}

Connector code never sees a secret. Vera mediates all egress through allow-lists and credential injection. If a compromised connector goes rogue, it can only reach the endpoints it was already allowed to reach — the Wasm sandbox is the blast radius.

QoS runs before dispatch. A team that suddenly starts issuing 10× its normal load hits its own quota — not production's spare capacity, not another team's headroom.