What we ship, what we disclose.

Grounded

Every answer is a cited quote or an explicit refusal

1. -Substantive answers include inline citations to the specific page, paragraph, and quoted text from district budgets, minutes, assessment schedules, or Florida Statutes Chapter 190 and related CDD chapters (189, 197, 218).
2. -The system rejects any output that tries to assert a legal fact without a quoted source.
3. -When the corpus does not contain the answer, CDDStream refuses rather than guessing.

Every response requires at least one quoted source or an explicit refusal before it can be surfaced. Refusals carry no citations by design.

Legal-advice guardrails

Layered automated defense, with each layer's status disclosed

1. -Multiple automated checks block legal-advice framing, imperative directives telling a reader what to do, and assertions of compliance or violation.
2. -A disclaimer-presence check rewrites or rejects substantive answers that lack the required disclaimer.
3. -A semantic classifier flags advice-like paraphrases the pattern-matching layers miss.

Every answer is audit-logged with the outcome of each automated check. Historical audit rows can reconstruct which check fired on any specific answer.

Tested

Adversarial prompts tested before every release

1. -We run adversarial prompts designed to elicit legal-advice responses.
2. -We run prompts that try to bypass our instructions.
3. -We run prompts about documents that do not exist.
4. -We verify every cited statute quote matches the source text.
5. -Before each release, we run a cross-district isolation test that fails the build if any district's data appears in another district's response.

All test outcomes are logged for audit. Release gates block deployment when tests fail.

Fast

Designed for cache-hit answers under a half-second

1. -A canonical answer cache is seeded with the most-asked questions per district so repeat questions skip the full retrieval and model call.
2. -Cold-path retrieval, for uncommon or district-specific questions, runs the full pipeline and targets 1 to 3 seconds.
3. -Compare to: a 15-minute phone call, or days of back-and-forth before a board meeting.

Per-district isolation

District isolation is enforced on every query

1. -District isolation is enforced on every request. Automated tests verify that no district's data can appear in another district's response.
2. -A release-time test seeds each district with unique tokens and fails the build on any cross-district leak.
3. -Database-level access controls block any path that does not go through the authenticated backend, and a nightly audit verifies the controls remain in place.

Our isolation discipline is layered: application-level enforcement, database-level access controls, row-level security policies, and a nightly drift audit.

Auditable

Every answer is logged with a defense-of-record shape

1. -Every request is stored with the question, the retrieved passages, the answer, the citations, and the disclaimer text that was shown.
2. -Every answer records which version of Florida law was in retrieval scope, so historical answers can be audited against the statute that was in effect at the time.
3. -The event log is append-only.
4. -Cost per answer is audit-logged.