Skip to main content

The platform model

The One sits between your source systems and everything that consumes data from them.

What it does

Source systems each hold their own version of the same customer, supplier, or patient. The platform resolves those into one governed golden record per real-world thing, and serves it three ways — to applications over an API, to AI agents over a governed endpoint, and to people through a console.

The word doing the work is governed. The same access control applies on every one of those three surfaces, evaluated per request against the caller's own identity. An agent cannot see what the person operating it cannot see.

The pipeline

Data moves through a fixed sequence:

StageDoes
IngestRecords arrive from a source system, each linked by a crosswalk
StandardizeValues are transformed into canonical form
ValidateConstraints are checked; violations recorded with a severity
MatchRecords that describe the same thing are identified
MergeMatched records consolidate; survivorship picks winning values
ServeGolden records are read, with access control and masking applied

Each stage depends on the one before. Matching unstandardized values produces false negatives; merging unmatched records does nothing.

What is governed

Four things are enforced on every request, independently:

  • Tenant isolation, in the database itself.
  • Permissions, at the request boundary.
  • ABAC policies, on each record as it is loaded.
  • Field masking, when the response is generated.

Because masking happens on response generation rather than per endpoint, there is no surface that returns an unmasked value to a caller who lacks permission — including the AI layer.

What is remembered

  • Lineage: every value traces to the source system that supplied it.
  • History: every record keeps its full version history.
  • Audit: every change records who made it, appended immutably.
  • Reversibility: merges can be undone, restoring what was absorbed.

Next


Last verified against commit 952ed91b (2026-08-03)