Authority is explicit
Behavior is resolved through scoped bindings and exact revisions. Lower-scope preferences cannot silently weaken higher hard authority; invalid authority paths are designed to fail closed.
SECURITY & GOVERNANCE
Make behavior authority visible before it becomes powerful.
Vira’s security model is built around explicit scope, exact identity, permissioned changes, immutable evidence where available, and reversible release operations.
This page describes product controls. It does not claim certifications, attestations, or compliance badges that have not been independently obtained.
CONTROL MODEL
Security is a chain of decisions, not a badge row.
Mutations are permission checked
Studio mutation paths require project-scoped actions and roles. Release preparation, publishing, rollback, teaching, and other governed actions remain distinct capabilities.
Runtime identity is preserved
Where receipt evidence is available, runtime explanations use the immutable server-owned record rather than reconstructing historical truth from today’s mutable configuration.
Learning is not deployment
A Teach correction creates governed evidence and enters learning. It cannot directly compile, publish, promote, or change active runtime behavior.
Optimized execution is bounded
Optimized artifacts are eligible only for their exact behavior identity and model target. A stale or mismatched optimized artifact does not become a new source of authority.
Marketing data stays out of Studio
The public website and authenticated product have separate measurement boundaries. Meta and TikTok remarketing scripts are not part of the Studio tracking policy.
FAILURE BEHAVIOR
Uncertainty should become a visible state.
Missing authority, stale identity, conflicting hard policy, or unverifiable optimized execution should not be disguised as normal success. The control plane distinguishes controlled fallback from fail-closed outcomes.
Optimized artifact staleCanonical fallback when the governed canonical path is valid
Unauthorized hard-policy weakeningFail closed
Runtime receipt cannot be persistedDo not claim optimized execution as trusted
Legacy trace lacks immutable receiptShow provenance as unavailable; do not reconstruct it as fact
PRIVACY BOUNDARIES
Public acquisition and private behavior data are different systems.
Public website
Marketing measurement is consent-gated. Event contracts prohibit prompt, response, trace, Lesson, signal value, credential, and raw form-message content from marketing analytics.
Studio
Authenticated product behavior uses first-party product telemetry policy, not advertising remarketing pixels.
Runtime traces
Privacy and retention behavior is handled as product governance. Technical identifiers and raw payloads are not treated as acquisition analytics.
BEFORE PRODUCTION COMMITMENT
Verify the controls that matter to your deployment.
Deployment architecture, credential handling, retention requirements, subprocessors, contractual terms, and any formal compliance obligations should be reviewed against the environment you intend to run.