Human approval
Material actions require an explicit approval model.
Security and control
AI should not outrun control.
CROM is designed for workflows where boundaries matter. The first question is not what AI can do. The first question is what it should be allowed to do, with what evidence, under whose approval.
Discuss Private DeploymentSecurity principles
Human review, scoped access, and evidence-aware operation.
Least-privilege planning
Tool and data access are scoped before a pilot runs.
Controlled tools
Only approved sources, tools, repositories, models, or APIs are connected.
Data boundaries
Sensitive data rules are defined before collection or processing.
Private deployment options
Deployment direction is planned around the customer's risk and ownership needs.
Evidence and closeout
Results should include what happened, what was validated, and what remains unresolved.
Responsible automation
Every pilot defines read-only, reversible, approval-required, and out-of-scope actions.
primal. does not present CROM as a system that can safely act everywhere. Formal assurance claims require future verification and are not part of this V1 site.