Managed, server & device profiles

Deployment responsibility matrix

These are proposed profiles. A profile must publish exact harness/protocol versions and supported stage/streaming capabilities before it is enabled.

Profile	Runs where	Boundary
Our servers	Contracted OptinRouter routing and action services	Hosted inspection receives the permitted content
Your servers	Certified package in customer-controlled infrastructure	No hosted fallback unless explicitly permitted
Your end device	Local routing adapter before egress and after return	Local checks require an installed certified adapter

Policy travels with the request

Signed configuration binds tenant, policy revision, tool/grammar versions and expiry. The device does not become the organization policy authority. Check revocation and capability support at the relevant boundaries. A missing local hook cannot be disguised as hosted local protection.

Offline and failure behavior

An expired policy, unsupported grammar or unknown processing region blocks a constrained route. Do not silently move data to another region or to managed infrastructure. Define cancellation, lost-device recovery, upgrade/rollback and secure credential handling per profile.

Data sovereignty coverage

Trace main inference, classifier/lookup side actions, storage and onward processing. Separate verified evidence, provider/operator attestation and unknown location. A residency configuration or report does not itself establish legal compliance.