Controls

Each value must come with a quote that is found in the parsed PDF and contains the value. Page and character offsets are derived from where the quote sits, never taken from the model.

A value without a verified source cannot be approved, and an edit can only correct a value to what the source says. The server refuses the request; hiding a button is not the control.

No bulk approval. A reviewer claims a value before deciding it, and only the claim holder can approve, edit, reject or flag it.

Every review decision is a SHA-256 linked event, and the whole chain can be re-verified on demand. The transition and its event are one write.

Selecting a value opens the PDF at the right page with the bound sentence highlighted in the text layer.

Field-level precision, recall and calibration against a hand-built answer key for each sample contract, recomputed on every read, with the pattern-rule baseline alongside.

Pinned model versions with a fallback list, checked against the provider catalogue for retirement dates, and a durable daily ceiling on paid calls. Over the ceiling, extraction falls back to pattern rules and says so.

Uploaded PDFs are parsed in memory for one request and discarded. Review actions live in the visitor’s own signed session for 24 hours.

SAML/OIDC identity, reviewer and approver roles, and four-eyes approval on high-value fields. The demo gives each browser session its own reviewer identity instead.

OCR, with values bound against the OCR text layer the same way. The demo accepts PDFs with selectable text and says so when it receives a scan.

A small open-weight model inside the customer’s network, so contract text never leaves it. The demo calls a hosted model through OpenRouter (a small open-weight model first, with pinned fallbacks) and shows which one answered.

Ingest from SharePoint, S3 and CLM systems; resolve amendments against the base agreement; push approved values to ERP or expense systems by webhook.