Most disclosure questions are not yes or no. They are how much. The Disclosure Ladder is Atrium's answer: seven distinct rungs between invisible and full document, each governed by policy, each step up requiring more authority — and, often, a steward in the loop.
Read each rung as a contract between the requester and the firm: this much may be disclosed, by this party, under this audit. No step is assumed; every step is recorded.
The caller receives no acknowledgement. The document is not in their universe. Default for documents whose classification is above the caller's clearance and whose existence would itself be sensitive. There is no error, no empty result distinguishable from a true negative — only silence.
policy default"A document matching your query exists." No metadata. No preview. No facets. Used where confirming existence is permitted but no further detail can be safely returned — typically across silos within the same firm, where the caller may need to know that a matter is live without knowing anything about it.
policy defaultClassification facets visible — matter type, jurisdiction, year, sector — but no text, no abstract, no parties. Useful for portfolio-shape inspection: how many M&A matters in 2024 in Frankfurt, without seeing any one of them.
steward · above InternalA machine-generated summary of the document with identifiers stripped. Parties become "Counterparty A", named clauses become their type, figures become orders of magnitude. The shape of the document is visible; nothing identifying remains.
steward · above InternalThe document itself, with named-entity, monetary, and personal data redacted in-place. The reader sees the structure and the surrounding text but not the specifics. Redaction is performed by a policy-driven pipeline; redacted regions are logged and reversible to authorised parties.
steward · above InternalThe full extracted claim text — assertion, basis, provenance, confidence — together with citations back to the originating clauses. No source binary. Enough to act on; not enough to forward verbatim. Used for the bulk of cross-silo legal research.
role + group authorisationThe source binary, fetched from the originating DMS at request time, through that DMS's own authorisation, served through Atrium with audit. Step-up authentication required. The fetch itself — caller, time, file, hash — is written to the append-only audit log before bytes leave the home system.
step-up auth + audit// every disclosure event records: caller · rung · classification · steward · justification · timestamp · policy version
A ladder without a hand is a hazard. Each rung above Internal binds the requester to a steward — a named human, in a queue, with a service-level on the response — before disclosure executes.
Rungs are not application code. They are versioned, signed Rego policy bundles, applied by an embedded OPA-compatible engine (regorus). Every disclosure decision cites its policy version.
L2–L4 disclosures above Internal route through a Silo Steward. Approvals, rejections, justifications are all logged; SLAs are configurable per silo.
L6 requires a second factor at request time, regardless of session age. The factor is bound to the specific document hash; it cannot be replayed against a different document.
Each event is hash-chained with the previous, canonicalised under RFC 8785 JSON, and periodically anchored to an external witness — proof that the log existed, in this state, at this time.
An independent, source-available WASM module re-verifies any audit segment. The firm — or its auditor — can trust the log without trusting the host.
A privileged role may force a rung up. The override carries its own audited event with caller, reason, original rung, granted rung, and policy version at decision time.
Result set is empty. No row is returned, no acknowledgement that one was withheld.
silent"3 matching matters exist in the European silo." No detail.
audited count"3 matters · M&A · 2024 · DE / FR / NL · sector: pharmaceuticals."
steward auto-approvedSanitised abstract per matter: counterparties masked, deal size in order of magnitude.
steward · 4h SLARedacted document text: structure visible, specifics replaced with redaction markers.
steward · 4h SLAFull extracted claims with citations. Enough to brief the team.
role + groupSource binary fetched from originating DMS, opened in viewer, fetch audited.
step-up auth