A request arrives from a subsidiary on a different DMS, a different IdP, a different jurisdiction of disclosure. Some of what you know can be shared. Most of it cannot. Atrium is the narrow pass — source binaries stay in their home DMS, claims travel, and a seven-rung ladder governs what each requester sees.
Every search hit, every cross-silo reference, every external request resolves to a rung on this ladder. Each step up requires more authority — and, often, a steward in the loop.
Caller receives no acknowledgement. The document is not in their universe.
policy default"A document matching your query exists." No metadata, no preview, no facets.
policy defaultClassification facets visible — matter type, jurisdiction, year, sector. No text.
steward · above InternalA machine-generated, identifier-stripped summary. Parties, named clauses, and figures removed.
steward · above InternalDocument with named-entity, monetary, and personal data redacted in-place.
steward · above InternalFull extracted claim text and provenance. No source binary.
role + group authorisationSource binary fetched from the originating DMS, served through Atrium with audit.
step-up auth + audit// every disclosure event records: caller · rung · classification · steward · justification · timestamp
Source documents remain in the firm's existing DMS — they are never copied, never re-hosted. Atrium ingests only the claims: extracted assertions, classifications, citations, provenance. On an L6 request, Atrium fetches the binary at request time, through that DMS's own authorisation, with the fetch recorded in the append-only audit.
iManage, NetDocuments, Litera, and other major legal DMS systems. Documents are read in place; nothing is replicated.
Each DMS's native scheme is mapped onto a canonical five-level ladder — Public, External, Internal, Restricted, Privileged.
L2 · L3 · L4 disclosures above Internal route through a Silo Steward queue. Approvals, rejections, justifications all logged.
First view of Restricted or Privileged in a session, bulk export, reclassification, override — all require a second factor and are audited.
OPA-compatible policy sidecar (regorus, embedded). Disclosure rules are versioned policy, not application code.
Hash-chained audit log periodically anchored to an external witness — the firm proves the log existed, in this state, at this time.
An independent, source-available WASM module re-verifies any audit segment. Trust the log without trusting the host.
Tenant Admin · Silo Admin · Silo Steward · Group Compliance · Client Relationship Partner. Each has scoped, audited capabilities.
