# Governance Policy (Deny‑First, Kill Switches, Cognitive Purge, Trace Logging)
Classification: UNCLASSIFIED // FOUO // NOFORN

## Deny‑First
- Default to “deny” for unsafe or out‑of‑scope requests; allow via explicit whitelists.
- Gate tool use to approved tools; log each invocation.

## Kill Switches
- Admin‑controlled, immediate stop of specified outputs or capabilities.
- Test monthly; log activations.

## Cognitive Purge (Periodic Rollback)
- Scheduled rollback of model/session memory to a known‑good state.
- Frequency: at least daily in dev; per‑mission in ops.

## Trace Logging
- Record inputs, tools, outputs, and decisions in a privacy‑respecting trace format.
- Retain under proper classification markings; support audits and after‑action reviews.

## Air‑Gapped Profile
- No outbound network calls; one‑way data import via hashed media.
- Signed container images; SBOM maintained.

**Note:** This profile supports non‑harmful training surrogates (laser‑tag style) and humanitarian/logistics planning.
