What Conductor does not do. Published limits.

Why this page exists

The limits are the specification.

A control you cannot describe the edge of is not a control, it is a claim. Every statement below narrows what we are promising, which is the only way the rest of what we promise is worth anything.

This page is written to be forwarded. If you are the person who has to decide whether your organisation can rely on this, send it to whoever will be blamed if it turns out we overstated something, and let them look for the gap. That is a better use of everyone's time than a proof of concept that discovers it in month four.

Conductor is in build. The Direction and Planning layers of Taskstreamer are in production today. Where a limit below is a consequence of the current build rather than of the architecture, it says so.

Scope of enforcement

Governance follows execution.

We cannot enforce guarantees on an agent we do not execute. If the work runs outside Conductor, we can register it, reconcile what it changed against what was authorised, and tell you who owns it. We cannot stop it. Anything claiming to wrap an existing agent estate without moving execution is selling observation and calling it control, and that includes the registration phase of our own adoption path.
Inside an execution engine's own tool scope, our reach ends where the engine's begins. We control what credentials the engine can reach and therefore what it can do to the outside world. We do not control every internal step it takes within the capabilities we have already granted it.
Reconciliation depends on what your connected systems record. Where a system of record does not attribute a change, or attributes it to a shared service account, our attribution inherits that limit. We will show you the reach of change attribution for your specific systems during evaluation rather than after.

Models

Nothing here establishes what a model is doing internally.

No control we operate says anything about a model's internal behaviour. Not its reasoning, not its intent, not whether an output is correct. Our position is that this is not currently establishable by anyone, and that a governance architecture should therefore be built so it does not need to be.
We do not certify model output quality. Conductor records what was produced, on what basis, and who accepted it. Whether it was any good remains a human judgement, made by a named person.
We do not prevent a model being wrong inside the envelope it was given. The boundary limits consequence, not error. An action classified as reversible can still be a bad action, and it will proceed.

The record

What the audit chain does and does not prove.

An append-only chain proves the record was not altered after the fact. It does not prove the record was complete when written. Completeness comes from the work and the record being the same object, which is an architectural property, not a cryptographic one. Those are different claims and we keep them separate.
The independent auditor is independent of Conductor, not of Taskstreamer. It is a separate component with read-only access, so a fault or compromise in the execution path cannot quietly rewrite what the auditor sees. It is not a third party, and we will not describe it as one.
We record that a briefing was presented and opened. We cannot record that it was read. That is a materially stronger position than an approval timestamp, and it is still not proof of attention.

People and process

The parts that stay yours.

We do not decide your thresholds. Conductor reads approval hierarchies, signing limits and dual controls from the systems that already hold them and asks a human to ratify each one. If the source system is wrong, the ratified rule is wrong, and the record will faithfully show a named person having approved it.
Policy-level ratification means fewer humans look at more work. That is the point, and it is a real trade. Sampled review and anomaly breakers are not item-by-item approval, and an organisation choosing that trade should choose it deliberately.
Conductor is not a security product. Capability boundaries limit what a compromised or misdirected model can reach. They are not a substitute for identity management, network controls, secrets management or monitoring, and they do not defend the rest of your estate.
We do not provide legal or regulatory assurance. Conductor produces evidence that supports human oversight obligations, including what Article 14 of the EU AI Act asks for. Whether your particular deployment is compliant is a determination for you and your advisers, and no vendor can make it for you.

Keeping this honest

This page changes when the product does.

A limits page that only ever gets shorter is marketing. When we find a new edge, it goes here, dated. When we close one, that is noted too, with what changed.

Last updated: 10 September 2026

If you find something we should have listed and have not, tell us and we will add it. That offer is not rhetorical. The people who have found the sharpest edges in this so far were prospects who did not buy.

What Conductordoes not do.