Packs

Start from what your model does.

Pick the deployment closest to yours. You will see the packs it needs, why each one is there, and what your reviewers can sign off on when every pack comes back QUALIFIED.

Choose your deployment All 8 packs

Your deployment

Support-desk router4 packs Document intake3 packs Extraction into a system of record3 packs Agent that takes actions4 packs Assistant over internal documents4 packs

Something elseDescribe it, we will map the packs

Support-desk router

Reads each inbound customer message and decides where it goes: queue, priority, automation or a person.

4 packs in this bundle

Job
Contact & ticket intent routingcontact-routingDoes the model read a customer message and send it to the right place?The job itself. Does each message land in the right place, including the ambiguous ones?
Data
Personal data handlingpii-handlingDoes the model keep people’s personal details where they belong?Customer messages are full of names, account numbers and addresses.
Data
Prompt injection resistanceinjection-resistanceIf a document or message contains hidden instructions, does the model ignore them?Inbound messages are untrusted. Some will try to reroute themselves.
Data
Scope & refusal behaviourscope-and-refusalDoes the model stay in its lane and decline what it should not do?The router classifies. It must not start answering customers.

Document intake

Sorts incoming claims, applications and correspondence into a fixed set of document types before processing.

3 packs in this bundle

Job
Intake document classificationdocument-classificationDoes the model sort incoming documents into the right categories?The job itself. Is each document in the right category, including mixed and unreadable ones?
Data
Personal data handlingpii-handlingDoes the model keep people’s personal details where they belong?Intake documents carry identity documents, medical and financial details.
Data
Prompt injection resistanceinjection-resistanceIf a document or message contains hidden instructions, does the model ignore them?Uploaded files are untrusted content and can carry hidden instructions.

Extraction into a system of record

Turns invoices, forms or contracts into structured records that are written to a system of record.

3 packs in this bundle

Job
Structured field extractionfield-extractionDoes the model pull the right values out of a document into the right fields?The job itself. Right value, right field, valid schema, every time.
Data
Personal data handlingpii-handlingDoes the model keep people’s personal details where they belong?Extracted records contain personal and payment data that must not spill into other fields or logs.
Data
Prompt injection resistanceinjection-resistanceIf a document or message contains hidden instructions, does the model ignore them?A line item in a supplier invoice is untrusted text.

Agent that takes actions

Turns a request into tool calls on real systems: create, update, refund, schedule.

4 packs in this bundle

Job
Tool-call argument extractiontool-argumentsWhen the model takes an action, does it fill in the parameters correctly?The job itself. Are the parameters right, and does it stop when the request is under-specified?
Data
Prompt injection resistanceinjection-resistanceIf a document or message contains hidden instructions, does the model ignore them?Anything the agent reads can try to trigger an action.
Data
Scope & refusal behaviourscope-and-refusalDoes the model stay in its lane and decline what it should not do?The agent has a remit. It must decline actions outside it.
Data
Confidential context leakagecontext-leakageCan someone talk the model into revealing what it was told in confidence?Tool results and system instructions must not leak back to the user.

Assistant over internal documents

Answers questions from retrieved internal documents and records, for staff or customers.

4 packs in this bundle · no job pack: free-form answers are not gated, the data & safety packs decide exposure

Data
Confidential context leakagecontext-leakageCan someone talk the model into revealing what it was told in confidence?The retrieved documents and system prompt must not come out verbatim.
Data
Personal data handlingpii-handlingDoes the model keep people’s personal details where they belong?Records about one person must not surface in another person’s answer.
Data
Prompt injection resistanceinjection-resistanceIf a document or message contains hidden instructions, does the model ignore them?Retrieved documents are content, not instructions.
Data
Scope & refusal behaviourscope-and-refusalDoes the model stay in its lane and decline what it should not do?Advice, actions and topics outside the remit are declined without over-refusing.

All 8 packs

One question per pack.

Job packs ask whether the model can do the work. Data & safety packs ask whether it can be trusted with what it sees. Open any pack to see exactly what it checks.

Request pack access

Job packs

Can the model do the job?

Contact & ticket intent routingDoes the model read a customer message and send it to the right place?contact-routing

A private model behind your support desk assigns one intent from a fixed taxonomy and a router acts on it: queue, priority, automation or a human.

What it checks

Label correctness against your reference set, per intent
Valid output shape on every response
Behaviour on ambiguous and out-of-taxonomy contacts
Coverage of every class, with edge classes weighted
Stability across repeated runs

Decision it supports

Whether the router may act on the model’s labels in production.

Typical owners

Support operations, platform engineering, risk.

Intake document classificationDoes the model sort incoming documents into the right categories?document-classification

Claims, applications and correspondence are sorted into a fixed document taxonomy before downstream processing.

What it checks

Class correctness against reference labels
Handling of mixed, partial and unreadable documents
Coverage across document types and sources
Stability across repeated runs

Decision it supports

Whether classified documents may skip manual triage.

Typical owners

Operations, document processing teams, risk.

Structured field extractionDoes the model pull the right values out of a document into the right fields?field-extraction

Invoices, forms or contracts are turned into structured records that feed a system of record.

What it checks

Schema validity of every emitted record
Field-level correctness against reference values
Behaviour on missing or conflicting fields
Numeric and date normalisation

Decision it supports

Whether extracted records may be written without a human check.

Typical owners

Finance operations, data platform, application owners.

Tool-call argument extractionWhen the model takes an action, does it fill in the parameters correctly?tool-arguments

An agent turns a request into a structured tool call. Wrong arguments mean wrong actions on real systems.

What it checks

Schema validity of every emitted call
Field-level correctness against reference calls
Refusal on under-specified requests
No fabricated identifiers or amounts

Decision it supports

Whether the agent may call tools without a human in the loop.

Typical owners

Platform engineering, application owners, risk.

Data & safety packs

Can the model be trusted with the data?

Personal data handlingDoes the model keep people’s personal details where they belong?pii-handling

The model sees names, addresses, identifiers and account details in prompts and retrieved context, and must not repeat, infer or forward them beyond what the task needs.

What it checks

No personal data echoed into outputs that should not contain it
Redaction and masking applied when the task requires it
No inference of identity from partial data
Behaviour on requests to reveal another person’s details

Decision it supports

Whether the model may process records containing personal data unattended.

Typical owners

Privacy, security, data protection officers.

Confidential context leakageCan someone talk the model into revealing what it was told in confidence?context-leakage

The model works with a system prompt, internal documents and retrieved records that end users must not see verbatim.

What it checks

System prompt and instructions not disclosed on request
Retrieved documents not reproduced beyond the answer
Behaviour under direct, indirect and multi-turn extraction attempts
Cross-tenant and cross-user isolation on a reference set

Decision it supports

Whether the model may be exposed to end users with confidential context attached.

Typical owners

Security, application owners, risk.

Prompt injection resistanceIf a document or message contains hidden instructions, does the model ignore them?injection-resistance

The model reads untrusted content: emails, tickets, web pages, uploaded files. Some of it will try to hijack the task.

What it checks

Instructions embedded in content are not followed
Task output unchanged under a reference set of injection patterns
No tool calls or actions triggered by injected text
Behaviour on encoded and multilingual payloads

Decision it supports

Whether the model may act on untrusted content without a human reviewing each item.

Typical owners

Security, platform engineering.

Scope & refusal behaviourDoes the model stay in its lane and decline what it should not do?scope-and-refusal

The model has a defined remit. Users will ask it for advice, actions and content outside that remit, some of it harmful.

What it checks

Out-of-scope requests declined with a usable response
Disallowed content categories refused on a reference set
No over-refusal on legitimate in-scope requests
Consistent behaviour across phrasings and languages

Decision it supports

Whether the model may be exposed to end users without a human in the loop.

Typical owners

Risk, application owners, customer operations.

Packs are delivered privately. That is what keeps your result honest.

A pack only measures something while the model has never seen its cases. Published cases end up in training data. Packs are licensed per organisation and never published, so your decision means what it says this quarter and stays comparable next quarter. How licensing works.

Not on the list?

Where a new pack works well.

Qualification evidence is strongest where the critical dimension can be checked against a reference rather than judged. Four signs your deployment is a good candidate:

The model produces structured or checkable output: a label, a class, a schema, a yes/no
A reference answer exists for the dimension that matters most
The model runs privately, so evidence has to be produced on your infrastructure
Someone has to approve the deployment and may need to defend that approval later

Free-form generation

Open-ended chat and long-form writing are harder to qualify against a reference, so there is no job pack for them. The data & safety packs still apply, and they are what decides whether such a model may be exposed to users. If your job is structured but not covered, describe it to us and we will say plainly whether a pack makes sense.

Not sure which deployment is yours?

Tell us what the model does in production and who has to approve it. We will tell you which packs your reviewers will ask for.

Describe your deployment Get started