The classifier labels the request. It doesn't make the call.

Why did this need fixing?

Free text arriving at a gateway has no typed purpose, subject or classification, so policy has nothing to apply to. The pattern classifier already existed in the core but was never invoked.

What did I do about it?

The classifier now builds envelope attributes and nothing more. It records the model identifier, calibration version, label, calibrated confidence and an input hash. The text itself is not stored. Typed attributes the caller supplied still win.

Decisions run on the recorded label, so replay never calls the classifier again. The Tier 0 defect 'classifiers never invoked' closed.

Which detail mattered?

What the classifier is not allowed to read mattered most. Identity is never read from text. Purpose and subject are never read from text either, because a purpose token in prose could turn a closed denial into an allow, and a subject id could choose which record is in scope.

Where are the limits?

Classifier confidence is itself policy: below the minimum it escalates. Calibration of a pattern classifier is still basic, which is a real gap in the alpha.

If you're building something similar?

Let a model narrow permission, never widen it. Whatever a model infers is evidence for a decision. The decision itself is made somewhere else.

Sources

Kognita is an open-source alpha. This note comes from Kognita PR #11 in the Kognita repository.