What Stratl is not

A product is defined by what it declines to do. These are Stratl’s refusals. They are written into the engineering rules of the codebase, not just the marketing.

Not a gateway

Stratl never sits between your agent and the model or tool it calls. It cannot slow a request, block one, or fail one. This is a security property, not a limitation: a system that can gate your AI is a system whose outage stops your business and whose compromise controls your AI. Evidence should be off the critical path.

Not an approvals engine

People approve things in your systems: a support lead in the ticketing tool, a medical director in the claims platform, a credit officer in the loan system. Stratl records that an approval happened, who gave it, with what authority, and what they decided. It does not route, remind or escalate. If it did, it would be one more place where the approval could be argued about.

Not an observability dashboard

Latency, cost, token counts, error rates: your tracing tool does that well, and Stratl reads from it happily. Stratl shows decisions, subjects, outcomes and integrity, which are questions an auditor asks, not questions an on-call engineer asks.

Not a security detector

Prompt injection, data exfiltration, jailbreaks: important, and someone else’s product. Stratl’s records will show what happened during an attack, which is useful afterwards, but it does not try to detect one.

Not a compliance guarantee

Stratl’s framework packs map a regulation’s controls to the record fields that help demonstrate them, and report coverage and gaps. They never say “compliant”. Compliance is a judgement made by people who know your business, your jurisdiction and your obligations; a record system can only make that judgement better informed and easier to defend.

Not a black box about itself

Everything Stratl does to your evidence, approving a notice, placing a hold, using your signing key, moving custody, is written into your stream as a signed record. The security page lists what is in place and what is not, on a date. Every claim on it links to the documentation page and the code that back it. See security claims, cross-linked.