Structure the facts
Separate organisation-specific facts from reusable policy templates so information has a clear home.
Policies, data & agent governance
Trust Center
Make the policy reflect the system.
A shared foundation for privacy, cookie, consent and data-handling information, with a research direction towards accountable AI agents.
Live policy platform · agent governance in developmentProduct strategy · Structured content · Multi-tenant publishing · Governance R&D
01 / The problem
What needed
to change.
Websites change faster than their policies. Suppliers, integrations and data-handling choices move on, while the information explaining them is often maintained manually in several places.
Why we built it
Trust Center grew from our Consent ePolicy work. Running that service exposed the manual effort involved and the gaps between what third-party integrations did and what a website said they did. We wanted a more connected foundation.
02 / The work
From the question
to the working product.
Publish in context
Deliver legal and privacy hubs on each organisation’s own domain, using the same underlying platform.
Extend the evidence
Develop a path from observed data-flow changes to a reviewed decision, an agent control and an approved policy update.
03 / The system
One set of facts. Different views of the truth.
The publishing foundation separates shared policy structures from the facts belonging to each organisation. The research extends that connection towards the behaviour of agents and integrations.
- 01
Organisation facts
The business, its contacts, services and processing choices.
- 02
Policy structure
Reusable templates and clauses, with organisation-specific content.
- 03
Branded delivery
A legal and privacy hub on the organisation’s own domain.
- 04
Operator controls
Administration and review of the information being published.
Cloudflare Workers and a shared database support the publishing service. The proposed monitoring-to-control loop is a further research programme.
04 / Research & development
From published promises to evidence of behaviour.
01
How do policies stay connected to a changing system?
The approach
Structure the facts behind public notices and investigate how a changed supplier, tool or data flow could trigger a review of the affected requirements.
What informs the next step
A policy update needs a traceable source and an approval decision. Publishing machinery alone cannot establish that the underlying practice is compliant.
02
What does an agent need before it can safely act?
The approach
Develop a bounded demonstration that detects a changed data flow, assesses regional requirements, controls the agent’s response and updates approved policies with an evidence trail.
What informs the next step
Observed traffic, provider statements and verified processing locations are different kinds of evidence. Unknowns and conflicting requirements must remain visible.
03
How do you evaluate the controls themselves?
The approach
Plan repeatable scenarios for changed permissions, unavailable tools, uncertain destinations and adversarial content. Compare task completion with the decisions to allow, hold or block an action.
What informs the next step
Security hardening and evaluation are part of the work. The test is whether a control reduces risk while still allowing useful work to proceed.
05 / Where it stands
Built, learned.
Still moving forward.
The policy-publishing platform operates today. It provides the foundation for our next research question: how to connect changing system behaviour with permissions and evidence that people can assess.
The existing policy platform gives this research a practical starting point. The next demonstration is deliberately bounded to one website and one connected agent workflow before broader use is claimed.
What comes next
Security hardening, scanner readiness, regional data-flow assessment and the agent-risk demonstrator are ongoing development. These are not presented as validated controls or a guarantee of legal compliance.
Another problem.
Another perspective.
All our work Our track record
Experience earned
by doing the work.
Client delivery. Products of our own. The everyday work of making them run. Each gives us a different perspective on what makes technology useful.
Explore our delivery track recordGrounded in real businesses
Our team’s work connects brands, creators and educators with their audiences, through digital platforms and the systems behind them.
Built and operated by us
We live with the products we create. Supporting them beyond launch informs the decisions we make on the next one.
Turning experience into what’s next
Recurring problems become reusable technology. The questions still unanswered become the starting point for our research.