Governance by Architecture is the principle that AI compliance constraints should be enforced at the infrastructure layer, not through policy documents or contractual promises. A compliance posture that depends on an LLM provider honoring a data processing agreement is a contractual promise. A compliance posture that prevents proprietary data from leaving the perimeter through architectural design is Governance by Architecture. Excipio embeds GDPR, HIPAA, and SOC 2 controls at the caching and routing layer, making compliance an outcome of the system design rather than a downstream audit activity.
Governance by Architecture is the principle that AI compliance constraints should be enforced at the infrastructure layer rather than through policy documents or vendor promises. If the architecture prevents data from leaving the perimeter, compliance is structural. If compliance depends on a contract, it is a promise that can be broken.
Contractual compliance places the burden of enforcement on legal agreements with LLM providers. Governance by Architecture places the enforcement mechanism in the system design itself. Excipio caches queries locally and routes only cache misses to frontier models, so perimeter controls are architectural, not contractual.
Excipio applies sensitivity tiering at the agent level. Each agent node carries a cache policy defining its data classification level, permitted LLM routes, retention window, and perimeter controls. A CFO agent handling board projections operates under a fundamentally different policy than a customer service agent. Policy is embedded in the infrastructure, not the prompt.
Excipio is designed to support GDPR, HIPAA, SOC 2, and the EU AI Act. Local vector embeddings prevent agent query intent from reaching external APIs. Per-agent sensitivity tiering enforces data classification at the routing layer. These are architecture-level controls, not contractual promises.
Agent deployments scale faster than legal review cycles. A single agentic workflow can fire thousands of LLM calls per hour. Contractual compliance frameworks designed for human-operated software cannot keep pace. Governance by Architecture enforces compliance at the speed of the infrastructure, not the speed of the legal team.