Restricted research stops before evidence retrieval or model inference.
Recorded approval of the research assessment, with reviewer rationale; this does not authorize data sharing.
Live Nebius receipt showing the NVIDIA model, tokens, latency, checks and human review outcome.
Permission-before-context workflow and the allowed/denied demonstration scenarios.
A live NVIDIA/Nebius research brief with references beside each material statement and an expanded authorized source excerpt

Inspiration

A research brief needs more than a convincing answer. A reviewer needs to know which evidence was permitted, what supports each statement, and who accepted the assessment.

That led to MatterGate: a legal and privacy research workflow built around permission before model context.

The central question was: can AI help prepare useful research while authorization, evidence boundaries and human responsibility remain explicit?

What it does

MatterGate turns a question into an inspectable research workflow:

Establish the requester, matter, purpose and jurisdiction.
Resolve permission before retrieving evidence.
Select only authorized source excerpts.
Use NVIDIA Nemotron 3.5 Lightning through Nebius Token Factory to draft a structured research brief.
Apply ten deterministic checks covering the output schema, citation linkage, scope and defined restrictions.
Require a separate human review decision.
Preserve a readable run receipt and ordered audit trail.

The demonstration asks whether a sales team can share EU customer contact data with a support vendor. The brief presents a summary, conditions, caveats and questions for counsel. References beside each material statement open the selected evidence, making inspection part of the reading experience.

A restricted merger-research request demonstrates the permission boundary: the application denies it before retrieval or inference.

Research permission, the model’s recommendation and human approval are separate decisions. Approving a draft that recommends “do not proceed” accepts that assessment; it does not authorize data sharing.

How it was built

MatterGate uses Python, FastAPI and Pydantic for server-controlled contracts and transitions; SQLite with FTS5 for scoped retrieval; and Jinja2, CSS and JavaScript for the interface.

The independently implemented Nebius adapter calls nvidia/Nemotron-3_5-Lightning with bounded context, output limits, a total deadline and validated diagnostics. The receipt records actual provider metadata and instrumented transport attempts.

Selected permission, retrieval and citation controls were adapted from the Apache-2.0 PriviLAB project. The repository preserves attribution, a pinned upstream revision, modification notes and source hashes. These adaptations execute in MatterGate’s control layer.

Development used AI coding assistance, followed by automated checks and an operator-guided live walkthrough.

Challenges

The first model configuration exhausted the output-token budget. A subsequent complete response exposed another problem: the initial contract asked the model to repeat identical claim text in separate fields, making exact citation coverage fragile.

The solution was statement-owned citations. Each material statement carries its evidence references, and the application projects that same text into the displayed brief. This removes duplicated wording without inventing citations or weakening source checks.

The interface also needed iteration. Tiny text became oversized after an initial correction. A consistent type scale, responsive layouts and browser verification produced a more readable experience.

Another lesson came from fixture fallback: users needed to understand that it creates a separate offline demonstration, rather than changing the original run.

What was learned

The output contract is part of reliability engineering. Clear structure makes model results easier to validate and inspect.

Workflow language matters too. “Permission granted,” “checks passed” and “draft approved” describe different events, and the interface must explain each one.

Citation linkage establishes traceability. Whether an excerpt actually supports a conclusion still requires human judgment.

What works today

The local suite passed 101 automated tests, and browser verification covered the complete fixture/review workflow plus 32 screen-and-viewport combinations.

An operator-guided live run completed with HTTP 200, one provider attempt, 302 output tokens and 1,515 ms of provider latency. It passed all ten structural checks and received a human draft approval. These are observations from one run, not a reliability benchmark.

Inline evidence navigation, receipt download, history filters, failure guidance and native 200% form zoom were also verified.

What’s next

The next priorities are target-user feedback, substantive source-support evaluation, repeated live trials and accessible judge testing.

MatterGate currently uses synthetic internal documents and an attributed public reference. Demo identities are freely selectable. It is a research demonstration, not legal advice, production authentication or a compliance certification.