Sourcine

A product of SAMDAM Mission Partners

The model is not the authority of record.

A requirements-driven secure delivery and runtime assurance platform for mission environments. Facts are bound to authorized sources before any model runs; the model may refine style — never author a fact, citation, or identifier.

Request a briefing Read the research →

Delivers non-AI, AI-enabled, and hybrid systems · Conductor always in scope · Veritas added when AI output must be source-attributed

Sourcine · Generated Output VERIFIED

Critical systems are scanned for vulnerabilities monthly, as required by RA-5(2) and defined in the authorized SSP §3.11.

sourceNIST SP 800-53 Rev 5 catalog

anchorRA-5(2) · SSP §3.11

audit hashsha256: 9f2c…a1e7

TEMPLATE-BOUND/ LLM REFINEMENT: STYLE-ONLY/ G0–G5 PASS

What Sourcine is

AI is an implementation option — not the product.

Sourcine starts from approved requirements, so the delivered system doesn’t have to be AI-enabled. The same gated discipline applies whether or not a model is ever invoked.

Non-AI

Deterministic mission systems

Dashboards, workflow automation, data pipelines, and APIs delivered through Conductor’s gated architecture, build, validation, and release — with audit-ready evidence.

AI-enabled

Source-attributed AI output

Model-assisted retrieval and synthesis governed by Veritas: deterministic resolution, citation enforcement, fact/synthesis labeling, and audit commit before display.

Hybrid

Deterministic core, governed AI edge

Deterministic application logic handles core workflows; Veritas governs only the AI-assisted portions that must be source-attributed and audit-defensible.

Runtime principle. Facts originate from governed source systems, deterministic selectors, compilers, validators, and audit records. The model is an untrusted synthesis component inside a controlled workflow — useful for explanation, never the authority of record.

How it works

Deterministic-first: facts before the model.

The system attempts structured lookup, identifier binding, and source-backed assembly before any LLM call. The model is invoked only when synthesis is necessary — and only after context and authorization are validated.

Authoritative source binding

Facts originate from approved systems, structured catalogs, policy repositories, and lineage-tagged records.

→ reduces unsupported factual generation

Deterministic selection

Queries bind to records through explicit IDs, controlled vocabularies, role-aware filters, and stable retrieval rules.

→ improves reproducibility & traceability

Programmatic assembly

Structured answers and protected fields are assembled before any LLM call.

→ prevents the model inventing protected facts

Constrained synthesis

The LLM is invoked only for synthesis or explanation over already-grounded context.

→ usefulness without factual authority

Validation gate

Output is checked for citation completeness, groundedness, protected-field preservation, and boundary violations.

→ blocks or flags unsupported output

Audit commit

Final disposition is committed with query hash, context package, model/version metadata, citations, and gate results.

→ creates the evidentiary record

Architecture

Three components, one assurance chain.

Each stage produces the artifact the next consumes. Skip a stage and the chain that makes the final system auditable breaks.

Requirements Generator

Formalization front end

Converts plain-language mission needs into structured, reviewable engineering and compliance artifacts — approved before any build begins.

BRD / PRD / SRS / TDD
Success criteria & acceptance
Candidate compliance framework
Traceable requirement IDs

Conductor

Security-gated delivery engine

Executes six sequential phases, each closed by a named gate with explicit pass/fail criteria. A failed gate blocks progression.

Risk seeding (P0 / P1) at design time
Requirement-to-evidence traceability
Baseline ingestion as gate criteria
Continuous release evidence

Veritas

Optional AI runtime assurance

Deterministic-first runtime governing AI-assisted output inside delivered systems, via a non-bypassable G0–G5 sequence.

Source binding & role-aware retrieval
Citation enforcement
Protected-field validation (fail-closed)
Tamper-evident audit commit

Conductor

Six phases, six gates.

Security and compliance defects surface at design time — when remediation is cheapest. A build that fails a gate cannot proceed until corrected or formally dispositioned.

Architect

Gate 1 · Architecture Completeness

Extract trust boundaries, sensitive data flows, and P0/P1 failure modes before code.

Trace

Gate 2 · Security Design Completeness

Map requirements to components, controls, and tests; assign IDs that persist downstream.

Link

Gate 3 · Pre-Build Readiness

Validate Baseline

Gate 4 · Security Baseline Completeness

Load STIG/SRG, CIS, cloud policy, and compliance criteria as mandatory gate inputs.

Assemble

Gate 5 · Pre-Release Validation

Deterministic tooling plus human-approved AI assistance build under gate constraints.

Stress-test

Gate 6 · Release Validate

Validate controls, vulnerabilities, evidence, and operational acceptance before release.

Veritas runtime

G0–G5: a non-bypassable path from request to audit.

Each gate produces both a pass/fail disposition and a machine-readable trace record — for every output channel carrying in-scope AI-assisted content.

Request Validation

Sanitize queries; primary prompt-injection boundary.

Identifier Resolution

Resolve entities against authoritative reference data.

Federated Retrieval

Query approved sources; tag every result with origin.

Citation Enforcement

Unsupported claims trigger block, re-query, or clarify.

Fact / Synthesis Label

Separate retrieved fact from AI-generated synthesis.

Audit Commit

Write the full chain to a tamper-evident log before display.

Delivered

Passed gates; shown with citations and audit metadata.

Blocked

Insufficient citation or boundary crossed; not shown.

Flagged

Shown with review status, per customer policy.

Clarify

System asks the user to constrain the query.

Compliance

Baselines as gate criteria — produced during delivery.

Applicable requirements are ingested, traced to deployed-service configuration, and evidenced — not maintained as a separate parallel paperwork track.

NIST SP 800-53

Controls mapped to gate criteria, cloud baseline policies, access controls, audit logging, and evidence artifacts.

FISMA / ATO Support

Traceability, baseline, validation, release, and residual-risk evidence accumulate throughout delivery.

FedRAMP Moderate / High

Approved regions, service baselines, encryption, and boundary controls aligned to your impact level.

DISA STIG / SRG · CIS

Hardening requirements translated into configuration tasks, validation tests, and exception workflows.

Sourcine in production

Not a prototype — shipping in commercial products.

The same deterministic-first discipline, productized for real markets.

Built on Sourcine

PursuitGuard

GovCon proposal-response acceleration

Extracts every requirement from a federal solicitation, grounds each response in supplied evidence, verifies compliance against FAR, DFARS, NIST & CMMC, and produces an audit package with full requirement traceability and provenance.

Requirement traceabilityEvidence-groundedProvenance audit

Visit PursuitGuard →

Built on Sourcine

Structured JSON Extractor

Documents → clean, structured JSON

Turns unstructured documents — PDF, XLSX, CSV, and images via OCR — into machine-readable JSON through a deterministic extraction core, with optional AI enhancement: the same deterministic-first discipline, applied to data capture.

PDF · XLSX · CSV · OCRDeterministic coreOptional AI

Visit Extractor →

Built on Sourcine

ReqGen

Plain-language needs → reviewable requirements

Turns plain-language mission needs into structured, reviewable BRD / PRD / SRS / TDD and a candidate compliance framework — with traceable requirement IDs, before any build begins.

BRD · PRD · SRS · TDDCompliance frameworkTraceable IDs

In development

How to engage

Four staged offers, one architecture.

A practical entry point for each stage of adoption — evaluation, pilot, production, or authorization support.

Assessment

Evaluate mission, data, governance, source readiness, and AI/non-AI assurance requirements.

You receive

Readiness report · source inventory · risk register

Pilot

Demonstrate Conductor delivery controls — and Veritas controls if AI is in scope — against an approved source set.

You receive

Working pilot · gate evidence · blocked-output tests

Production

Implement the full governed application, analytics capability, or hybrid system inside your boundary.

You receive

Deployed system · release evidence · operational handoff

Evidence Accelerator

Support security review, ATO workstreams, oversight, or compliance evaluation.

You receive

Control mapping · audit samples · residual-risk disposition

What Sourcine does — and does not — claim

Assurance boundary

Source attribution is not source verification. A cited, gated output traces which authorized source supported a claim; it does not verify that the source is current, correct, or complete. Source quality assurance remains a customer governance responsibility.

Gate completion is not a vulnerability-free guarantee. It evidences that defined architecture, control, test, scan, review, and release criteria were executed. Assurance depends on the quality of the customer-approved gate criteria.

Veritas governs only mediated AI paths. Any output channel carrying in-scope AI-assisted content must route through the G0–G5 sequence, or be covered by a documented, customer-approved equivalent control.

Start here

Bring us the mission. We’ll bring the evidence.

Start with an assessment: we characterize your mission, data sources, query profile, and assurance requirements — then scope a pilot against an approved source set.

Request a briefing

samdam.biz 301.904.1660 info@samdam.biz