WhippleScriptPrivate data cannot drift into a broader audience.
If CRM data is Operator-only, a workflow cannot write it to a public channel, return it to an uncleared caller, or send it to an unapproved model.
WhippleScript for data owners
Let the team automate. Keep the policy yours.
Team members can create their own AI workflows inside a signed governance envelope. You define which data may reach which people, models, and destinations—and the checker rejects workflows outside it.
information-flow guarantee report
crmOperator readers onlyproven
providerselfhost:llama clearedallowed
smtpCRM content → public replydenied
hatchesnone in trusted surfaceclean
The operating model
Separate authorship from authority.
The people closest to the work should be able to automate it. They should not need—and do not receive—the power to rewrite the organization’s trust boundaries.
Workflow author
Builds and improves the automation.
Authors connect approved resources, test the workflow, read denial diagnostics, restructure unsafe flows, redact records, and file precise escalation requests.
- Cannot weaken or sign policy
- Cannot clear a model provider
- Cannot bless a sensitive release
Governance owner
Defines and signs the boundary.
Governance labels real resources, sets provider and human clearances, and decides whether a narrow declassification or endorsement crossing is justified.
- Policy is reusable across many workflows
- Every exception is explicit and reviewable
- Tampering invalidates the attestation
Practical IFC
Policy follows the data through the workflow.
Information-flow control is not just access at the front door. Labels derive through joins and survive handoffs, facts, child workflows, model prompts, tool results, and final outputs.
Untrusted input cannot silently steer trusted state.
Internet or inbox content cannot shape a higher-integrity sink unless it passes through an explicit, authorized endorsement boundary.
An assistant cannot become a side door.
An agent serving a user is denied every read above that user’s clearance. Provider clearance is independently checked for all context sent to a model.
Govern once
Label the environment, not every author’s variables.
The signed envelope names real file stores, channels, providers, humans, and readers. Workflows are checked against that shared policy before they run.
Governance
Label resources
CRM, inbox, SMTP, file stores, model providers, and principals get confidentiality and integrity declarations.
→
Teams
Author freely
People implement their own workflows and repair denied designs without waiting for central engineering.
→
Compiler
Enforce universally
Every rule is checked. Unlabelled resources fail closed as flagged risks. The report states exactly what was proven.
Exceptions without ambiguity
Make dangerous flows visible.
Some releases are legitimate. WhippleScript gives them a narrow, source-marked path instead of turning one exception into ambient permission.
Physically remove fields before release.
redact … keep creates a value with only the named fields. Dropped fields are absent both statically and at runtime; downstream code cannot recover them.
Release a schema-bounded result.
A marked coercion can cross confidentiality only with a matching signed grant. Its output schema bounds what leaves, and the crossing appears in the report.
Vouch for untrusted input explicitly.
A marked judgment can cross the integrity boundary under a matching grant. Raw low-integrity data still cannot write trusted state.
Do not let the attacker choose the secret.
Low-integrity input is denied the ability to steer its own declassification. The escape hatch’s control path is governed too.
Tamper evidence
The checked policy is the signed policy.
A governance agent signs the envelope. The signed artifact carries a SHA-256 attestation over policy content; edited content fails verification instead of quietly changing the claim.
Standing evidence
A report people can review.
The guarantee report lists proven invariants per resource, violations caught, ungoverned risks, cleared principals, and every accepted declassify or endorse crossing in one trusted-surface section.