2 Part two of two · part one was what it is
How we're working to build trust.
We know LLMs have limitations and we're working on building five layers to enable teams to use this technology without assuming everything it produces is correct nor exposing sensitive data. This is a work in progress, and here's an insight into where our thinking is currently at.
Knowing what to trust
Who stood behind this page.
Two questions, kept apart. How well is this evidenced? And who has confirmed it? A page can be well sourced and unconfirmed, or confirmed by three people and still misquote its source. So the wiki records both, on the page, where a reader sees them.
A model can write a page. It can never award that page your trust. Confirmation carries a name, and the system refuses a name that belongs to a machine.
Every claim cites its source. Anything the model worked out for itself says so.
When two pages disagree, the wiki says so on the page and leaves it open. A person closes it.
Nothing is deleted. A page nobody stands behind any longer is marked as finished and stays readable at the same address, so a line of thinking that was dropped can still be found. Pages retire; they do not die.
When a second model agrees, that is worth recording and little more. Both were trained on much the same material, so they tend to be wrong in the same places.
Outcome verification in municipal contracts
Payment releases only when independent monitoring confirms the target. (greenline-briefing.pdf) ✓ R. Bennett, 4 Sep
Verification typically lags delivery by two quarters. (alpine-transition.pdf) unverified
In designTicking every citation is the cost that killed footnotes. So each week the wiki names the three unchecked claims carrying the most weight, and asks for those. Three a week is a habit. Four hundred is a refusal.
What it will not do
Things it will not do.
Most systems of this kind are built to say yes to whatever you ask. This one has a short list of things it refuses, and that list is not a setting anyone can turn off. The refusals are the point: they are how the rest of it stays worth trusting.
Each refusal is there because saying yes would quietly ruin something. A machine that can grant approval makes approval meaningless. A machine that can answer questions about what a colleague has been doing turns a shared memory into a monitoring tool. A machine that can tidy away a page can erase a disagreement.
It cannot say your work is approved. Only a person can confirm a page, and the confirmation carries their name. If a machine name is entered, it is rejected.
It will not tell you what a colleague has been doing. Ask what the organisation knows and it answers. Ask who wrote what, or who has been talking to whom, and it declines and says why.
It cannot delete a page. Work that is finished is marked as finished and stays readable. Nothing disappears to make the picture tidier.
It cannot settle a disagreement. Where two pages conflict it says so, on both, and leaves it for people to resolve.
It cannot move anything to your colleagues on its own. Your pages stay yours until you send them, and sending is a decision you make one page at a time.
Each of these is enforced by a check that runs on every change.
It reaches the board you already use
It reaches your dashboard.
Everything the wiki computes — the goal nobody has resourced, the synthesis whose ground has moved underneath it, the page the argument leans on that nobody has confirmed — is worth nothing sitting in a file nobody opens. The wiki proposes and the meeting disposes, so it is written into the board the team already runs on, as rows a person can agree with or throw out.
Today it writes into Notion. Nothing about the wiki end is Notion-shaped, so the same readings can go wherever your team already tracks work.
It only ever writes “Not started”. In progress and Done are a person's verbs. A row the meeting has touched is never edited again.
It never deletes a row. A suggestion that was overtaken gets a comment saying so. The board keeps a record of what was proposed, including the bad ones.
Every row says where it came from. A tool, a signal, a date — so anyone can re-derive it. Without it you have an assertion, and people learn to scroll past assertions.
One fact, one row. Eight goals with nothing committed goes up as a single row. List the same fact eight times and it buries whatever is actually broken.
Prose and structure cross between the two. Money stays where it is. Private pages, figures and the relationship log stay in the wiki. A budget line is the most re-shareable object there is.
Both sides stay theirsThis reads the wiki and the board, names what differs between them, and makes only the changes a person would recognise as obviously right. Anything that overwrote either side would destroy the thing that makes it worth having.
Decide which of the eight unbacked goals get a commitment this cycle — or a decision that they are not being pursued
One of twelve rows the wiki put up for the September review. The From field is the part that matters: it is what makes the row a suggestion you can check rather than one more notification.
- Notion
- Jira
- Confluence
- Asana
- Trello
- Linear
- monday.com
Notion is wired and running. The rest have not been built. They are listed because adding one is a plug-in and nothing deeper, and because saying which is which is the whole habit.
Yours stays yours
Your wiki stays yours.
Each person has their own wiki. Teams have a shared one. Only what you choose travels, and it arrives saying where it came from. An improvement a colleague makes flows back to everyone.
Where does my stuff go? Nowhere, until you send it. Your wiki is yours; a shared one is a separate copy that only ever receives what a person chose to send, and each wiki's health page now says what of yours has reached which commons. What comes back? A read-only copy of the commons, refreshed daily, so your wiki can answer with what the group knows — but nothing from it is written into your pages without you deciding.
Four settings govern who can see a page. Private never leaves your own copy, not even its title. Internal reaches trusted colleagues. Unlisted is reachable by link. Public is the open web. New pages start private, and only a person moves one up.
.commons/ folder your wiki can read and measure against, but never merges. Counts are pages that have actually arrived as of 21 September 2026, counted per commons; the faint arrows are connections that exist and have carried nothing yet, which is a fact about people rather than about the tooling. The wikis are unlabelled on purpose. An earlier version of this diagram put colleagues’ names on the open web with a page count beside each one, which is per-person activity data about people who did not agree to publish it. The shape of the sharing is the argument; who is behind each circle is not ours to show.Start with one wiki.
One person, one folder of sources, one week. If it doesn't earn its place by then, it isn't for you.
We set it up with you, work out what it is for and what it should push back on, and bring in your first sources together. Email Gurden and we will find a time.