Matter-scoped controls reduce discovered risk while introducing usability and refusal tradeoffs. The demo supports conditional review, not a production-ready conclusion.
Control integrity is distinct from PSA usability and not a compliance certification. Company-side Safety/Security rate across 24 governance sessions per configuration
PSA usability
A higher usability value does not override approval blockers. Post-session replay usability across the matched governance matrix
User burden
Lower user burden can trade off against stronger governance. Post-session replay burden across the matched governance matrix
A and B are blocked; C is conditional review with residual work.
A governance demo, not a commercial-model safety ranking or compliance certification.
MATCHED STUDY EDITION
Risk discovery · separate red-team demo
96 sessions per configuration. A: 286 turns; B/C: 288 each. All metrics are descriptive and nonrankable.
Three configurations × twelve scenarios; 288 coverage-adjusted sessions
Recorded measures for this edition. Each metric keeps its own meaning and direction.
Discovery signal, not a confirmed vulnerability rate or safest-system score. Potential-risk flagged turns / analysed turns; A286, B288, C288
Refusal rate
More refusal can be appropriate for unsafe requests; no winning direction is implied. Refusal turn rate in the separate red-team matrix
Engagement rate
Useful as a response tradeoff, not proof of safety. Engagement turn rate in the separate red-team matrix
No-response rate
Descriptive operating evidence, not production reliability. No-response turn rate; orchestration caveats apply
Judge-confirmed vulnerabilities
Zero observed does not establish absence of risk. Judge-confirmed findings in 96 sessions per configuration
Potential-risk discovery must not produce a safest-system rank.
Zero judge-confirmed vulnerabilities for all configurations is not a clean bill of health.
Structured-output, tool compliance, throttling and accounting issues limit the run.
THE SAVED OBSERVATIONS
What the evidence shows.
A
Public-like assistant
Governance configuration A · same backend model family
BlockDemo 1 approval disposition
Inspect control integrity alongside usability and burden, then read the separate red-team discovery results.
Recorded gap
Approval disposition
Block in this governance demo; the control and user-side metrics remain separate.
Study scope
No confirmed exploit claim
Zero judge-confirmed vulnerabilities were recorded; potential-risk signals and operating caveats remain.
Study scope
Risk discovery
Demo 2 potential-risk turn rate is 32.9% across 286 turns; lower discovery is not proof of a safer system.
B
Enterprise guarded chat
Governance configuration B · same backend model family
BlockDemo 1 approval disposition
Inspect control integrity alongside usability and burden, then read the separate red-team discovery results.
Recorded gap
Approval disposition
Block in this governance demo; the control and user-side metrics remain separate.
Study scope
No confirmed exploit claim
Zero judge-confirmed vulnerabilities were recorded; potential-risk signals and operating caveats remain.
Study scope
Risk discovery
Demo 2 potential-risk turn rate is 34.7% across 288 turns; lower discovery is not proof of a safer system.
C
Matter-scoped RAG
Governance configuration C · same backend model family
Conditional reviewDemo 1 approval disposition
Inspect control integrity alongside usability and burden, then read the separate red-team discovery results.
Needs review
Approval disposition
Conditional review in this governance demo; the control and user-side metrics remain separate.
Study scope
No confirmed exploit claim
Zero judge-confirmed vulnerabilities were recorded; potential-risk signals and operating caveats remain.
Study scope
Risk discovery
Demo 2 potential-risk turn rate is 6.2% across 288 turns; lower discovery is not proof of a safer system.
METHOD & SCOPE
How this study was run.
Demo 1 compares three governance configurations across six work journeys and four PSA roles, yielding 24 sessions per configuration and nine deduplicated risk patterns overall.
Demo 2 separately tests twelve red-team scenarios. Configuration A has 286 turns; B and C have 288 each. Potential-risk rates are per turn, not per session.
The same backend model family is used; this is a governance configuration demo, not a commercial-model benchmark.
The field-date metadata is 25 March 2026; the richer saved report does not independently date each demo. No newer field date is invented.
LIMITATIONS
What this does not establish.
Zero judge-confirmed vulnerabilities does not establish safety or absence of risk.
Potential-risk discovery rates are nonrankable as a safest-system measure; fewer discovered flags can reflect coverage and response tradeoffs.