---
title: Baseline trust rails
---

# Baseline trust rails

> _Auth, PHI handling, telemetry rules, eval hooks, guardrails, and audit are baseline rails. They are not the product thesis, but they must be present from day one._

Nexus documentation treats trust rails as baseline runtime rules rather than as the main platform identity.

## The baseline rails

| Rail | Rule |
|---|---|
| Auth | `n1r.core` acquires and refreshes tokens; Pinax uses the token it is handed; `api-backend` enforces policy |
| PHI-safe telemetry | No raw prompts, completions, or PHI-rich payloads in default traces |
| Model traffic | Goes through LiteLLM unless explicitly approved otherwise |
| Runtime bounds | Hard timeout and cancellation path are mandatory |
| Eval and guardrails | Available as baseline runtime hooks and enforcement points |
| Audit | Artifact lineage and run metadata must be durable and readable |
## What these rails are not

These rails are the current baseline. They are not a separate product identity or branding layer.