Claude in the control room: admitted evidence, not prompts

A button that promised more than it sent

Our estate monitor has a map. Click a site, the recovery site in Rochester for instance, and an inspector opens with that site's circuits, its figures on every layer and the attention items touching it. At the bottom sat a button: "Ask Claude about this site."

An independent review found that the button did not do what it said. It opened Claude on the estate monitor as a whole. The site name was in a prompt the button composed, but our Claude endpoint does not accept prompts, so the prompt went nowhere and Claude received the estate-wide packet. The answer was about the estate, not about Rochester.

The quick fix was to rename the button. The real fix was to decide what "about this site" is allowed to mean at a boundary that, by design, will not take free text. How we made that decision says most of what we believe about putting a model into an operations product.

The boundary takes three words

A request for a Claude interpretation in the product has exactly three fields: the organization, the surface and the intent. The organization must be a registered reference organization. The surface must be one of ten named workspaces, from the command center to the estate monitor. The intent must be one of three verbs: explain, prioritize, brief. Any other key, any extra field, any value outside those lists, and the endpoint refuses the request before anything is sent to a model.

There is no field for a question. There is no conversation history, no system prompt override, no tenant identifier the browser can choose, no source it can nominate. The facts Claude reads are built on the server from the organization's own reference packet for that surface, capped at sixty-four facts and forty-eight thousand bytes, and every fact names the source it came from.

People sometimes describe this as limiting the model. We think of it as the opposite. The easiest way to keep a model from answering the wrong question is to never let anyone ask it one. What the interface can ask is a short, closed list, and every item on that list has been designed, tested and reviewed for what evidence it should carry.

What came back has to cite what went in

The response is just as closed. Claude returns a summary, two insights and one next review, each insight citing the identifiers of facts it was given. A citation to an identifier that was not in the packet fails validation, and so does a next review that is not on the packet's own list of allowed next steps. The next steps themselves only ever open an inspection page inside the product. They cannot approve, execute, publish, notify or change a source.

The reply also has to echo the request it answers: the same organization, the same surface, the same intent. The browser drops a reply that arrives for a different request, which matters more than it sounds once people start clicking between workspaces while an interpretation is still being written.

When any of this fails, the panel shows one of a fixed set of messages, and none of them repeats provider text. An operator sees "Claude's response did not pass the evidence checks. No interpretation was accepted," not a stack trace or a half-rendered paragraph.

Adding a fourth word without opening the door

So the question for the Rochester button became: can a request carry "this site" without becoming a prompt? The answer we shipped is a fourth, optional field, focus, with two parts: a kind, which can only be "site", and an identifier, which must be one of the seven sites on the map. A test holds that list equal to the map's own list, so a site added to the map without being registered cannot be asked about, and a registered site removed from the map cannot linger.

Focus is accepted only on the estate monitor surface. Sent with any other surface, or with any extra key inside it, the whole request is refused. When it is accepted, the server builds that site's packet the way the inspector reads it: the site's state, its figures on each layer, every circuit with an end there, and the attention items that touch it.

One detail mattered more than we expected. Some of the map's per-site figures are fixed sample apportionments of an estate-wide reading, marked with an asterisk on screen. In the packet they cross as modeled rather than observed, and say so in their own words, so Claude cannot describe a share of a total as a measurement taken at that site. The reply must also echo the same focus, and a reply about Rochester is dropped if the panel has since moved to the clinics.

What the operator actually sees

From the outside none of this is visible as machinery. Select the recovery site, press the button, and the assistant opens on a panel headed "Estate monitor · Recovery site (Rochester)." While the interpretation is written, a working card shows the intent, the organization and surface, an elapsed-seconds counter and the stages of the request, and nothing partial appears until the whole reply has passed its checks.

What arrives is labelled as an interpretation that needs human review, never as a finding. Each insight carries chips for the facts it cites, and choosing one moves the evidence inspector to that exact fact, so a reader can check the claim against the reading it came from in one step. The suggested next review opens the estate monitor or another inspection workspace, which is the most a model in this product is ever allowed to do: point a person at something worth their time.

The objection: this is too much ceremony

The strongest objection to all of this is that it throws away most of what makes a model useful. Operators want to ask anything, in their own words, about whatever is on the screen. A closed list of three verbs and seven sites feels like a form, not an assistant.

We have a free-text assistant in the product as well, and it answers from the same semantic layer with deterministic queries, so it can be asked anything and will decline what it cannot ground. What we have refused to do is hand a model free text and production-shaped evidence at the same time, because that is the combination where a confident paragraph about the wrong thing reaches an executive in a format that looks exactly like a right one.

The ceremony also turns out to be cheap where it counts. Adding site focus took one field, one allowlist, one packet builder and one echo check, each with a test. The next scope we add will take the same four pieces. A boundary that can be extended that predictably is not slowing the product down. It is the reason we can keep extending it.