Your most sensitive knowledge,
governed by design.
Meshline is a permission-aware evidence graph. Clearance is enforced in the query itself, source bytes are hash-addressed and never destroyed, and in the sovereign tier nothing leaves your perimeter. This page is the due-diligence dossier: what is enforced, where it runs, and what we can prove.
One evidence graph. Four clearances. Move the role control and watch the same query return less. Nodes above your tier redact in place rather than vanish; their edges go dashed. Nothing silently disappears. RBAC writes its refusals (blocked air-gapped egress, refused small-cohort aggregates) to an append-only audit log.
See the redaction. Not the promise of it.
Clearance is one of five persisted tiers (T1 Public through T5 Air-gapped). A user sees any node whose tier is at or below their persisted ceiling. The role labels above are an illustration; in the product the ceiling is read from the authoritative users table, never inferred from a role at request time.
Access control belongs in the query, not in a code review.
Isolation is enforced in the graph query compilers, not in application code. The application never writes raw Cypher; every operation carries a context and the access predicate is appended to the compiled query. Seven layers stack on top of that single chokepoint.
Access control that lives in the query, not the handler.
Tenant, vault, tier and cell
Every node a query can return is constrained to the viewer: org_id and vault_id must match, the node tier must be at or below the persisted ceiling, and the node cell must be in the allowed set. The predicate is parameterized and compiled into every read.
Relationships carry their own tier
Graph edges are tier-scoped too. An edge whose tier exceeds the viewer ceiling is dropped from expansion, so a high-tier relationship cannot leak between two otherwise-visible nodes.
Intersection, not union
A derived claim or entity that inherits ACLs from multiple source artifacts is readable only if the viewer satisfies every source ACL. Inheritance tightens access; it never widens it.
No invisible stepping stones
Multi-hop traversals never start from an unfiltered seed. The root node and every node on the path are re-checked against the full predicate, so an invisible node cannot be reached as a bridge.
Minimum-cohort protection
Counts and group-by buckets below a per-tier minimum cohort are refused or dropped, so small cohorts cannot be inferred from aggregates. The threshold is a tunable defaulting to 5 for tiers 1 to 3 and 1 for tiers 4 to 5.
Server-side redaction, no leaked ids
Where a source page contains segments above the viewer ceiling, the non-visible regions are blanked. Redacted regions reach the client with no id and no content; the position is visible the way a viewer shows a blank, the bytes and ids are not.
Air-gapped allowlist
In a Tier-5 air-gapped session the application refuses any outbound call to a host not on the T5 allowlist (default localhost) and audit-logs the block. Non-T5 sessions are unaffected; this is the application-layer companion to the operator network controls.
These predicates fail closed. A query with no active vault throws rather than returning rows, and even maintenance operations refuse without a vault scope. Cross-tenant and cross-vault reads are not blocked by a check that a handler might forget; they are structurally unreachable because the predicate is part of every compiled query.
Meshline’s own administrator account has no standing access to your content. It is clearance-zero by default and is blocked exactly like any unauthorized user. Vendor access exists only as an explicit, time-boxed, audited break-glass grant that you approve, and every use of it lands in the same append-only log you can read.
Every query, retrieval and model call lands in an append-only, regulator-grade audit trail, including the denials. Sample rows, sanctioned and redacted.
Every answer,
accountable.
Every row links to the exact evidence touched · nothing is retroactively editable
The served frontier model is a fixed quality floor in all three tiers. The tiers differ only in where your data lives and where inference runs. Data residency (where prompts are processed) and zero data retention (what the API keeps) are independent guarantees; we never conflate them.
The model stays frontier-class. Only the perimeter moves.
The sovereign tier is the only one where inference runs fully on your hardware, and the only tier where the air-gapped egress control makes that guarantee complete. Local frontier inference is gated on wiring the on-prem model server inside your deployment; the same container set lifts across all three tiers without architectural change.
The sovereign tier's zero egress is enforced inside the deployment. For the API tiers, zero retention, no training and in-region residency are contractual commitments about the in-region API provider (AWS Bedrock, Azure OpenAI or Vertex), not controls enforced by Meshline code.
Every answer resolves to its source bytes. Nothing captured is destroyed.
Two append-only stores anchor every answer. A hash-addressed evidence ledger holds the source bytes; an append-only audit log records who reached what, including the access decisions RBAC refused. Isolation is compiled into the query, not trusted to a handler.
Nothing is asserted without a source. Nothing captured is destroyed.
Append-only evidence ledger
Every ingested source artifact is written to an append-only ledger, keyed by a hash-addressed content stamp and stored with its raw bytes. Removing a source soft-deletes the row; the bytes and the record remain. Captured evidence is never destroyed and never merged.
Chain of custody on every claim
Each artifact carries its source identity, capture and ingest timestamps, byte size and type. Graph claims materialize an evidence edge to each source segment, so a model answer resolves to the exact bytes it came from. Superseding belief is non-destructive: stale claims are marked deprecated, never deleted.
Append-only audit log
A separate append-only log records access events with the actor, org, resource and tier. RBAC writes to it actively: blocked air-gapped egress and refused small-cohort aggregates both land as audit events. It is an indexed append-only table, not a cryptographic hash chain.
Tenant and vault isolation
org_id is the tenant boundary; vault_id is a hard isolation boundary within an org. The same source page synced into two vaults becomes two independent assets. Even the org owner bypass for per-source ACLs never crosses org, vault, tier or cell.