Industries / Aerospace and defense
Answers your security officer can clear.
You work under export control and defense contract rules. Every answer names who approved its source, and who is allowed to receive it. Cognatum supports safety and record keeping demonstrating your commitment to it.
Without Cognatum
Who was allowed to read that?
“The assistant is built, tested, and funded. It has been sitting in governance review for four months.”
Before an assistant reaches a program, export control and security ask the same thing: where did this come from, and who may see it?
Engineering answers sit in drawings, specifications and process sheets, and some of that is controlled technical data.
An index that reads everything reads those too, and a system that ranks by relevance has no view on who is asking.
A drawing goes to a new revision and the answers built on the old one carry on, because nothing links them. So the assistant does not leave the pilot, because nobody will sign a boundary that cannot be shown.
Yes. It carries no control markings, so it can be sent with the standard supplier packet.
No source · no approver · no date
Why this industry
What a program review actually asks.
Three things decide whether an assistant clears review on a defense program. Each one turns on whether the answer can be traced afterwards.
- Export control. Technical data is defined by regulation, and releasing it to a foreign person is a transfer whether or not anything is shipped. Clearance is decided when the answer is made, and a refusal is recorded rather than silent.
- Controlled unclassified information. Contract clauses reach the systems that store and move it. Approved, numbered entries give an assessor a defined object to look at, where an open index gives them an unbounded one.
- Supplier flowdown. What you tell a supplier becomes a requirement you own. The wording goes out as approved, from the revision in force, with the approver still attached to it.
What we will not claim
None of this makes your company compliant with export control law or with any defense contract clause, and we will not tell you it does. Assessments look at organizations and programs, not at the software they buy.
What Cognatum supplies is evidence toward duties you already carry: the named approver, the date, the version history, the source behind every answer, and a record of who was refused.
Which retention period applies to client trade communications?
Entry SOP-4471
- v4 In force
Retention extended to seven years for client trade communications.
D. Whitfield, Records management · 2026-07-02
- v3 Superseded · retained
Chat channels brought into scope.
D. Whitfield, Records management · 2025-11-14
- v2 Superseded · retained
Exception process added for legal hold.
M. Alvarez, Compliance · 2025-03-09
- v1 Superseded · retained
First approved version.
M. Alvarez, Compliance · 2024-06-18
→ what the entry said on a date is a lookup
With Cognatum
Five things that need approving.
What an assistant answers from on a program is not one kind of thing. Five classes carry a control duty of their own.
Export classification
The determination, on the record
Whether an item is controlled, and under which list, is a determination somebody made. The entry carries it, with the approver and the date.
Technical data
Drawings that answer questions
Specifications and process sheets answer engineering questions daily. Served as entries, each one carries the clearance that decides who sees it.
Contract requirements
Clauses that reached you
A clause flowed down from a prime becomes a requirement your team answers against. The answer comes from the version in force.
Supplier qualification
What the supplier was told
Qualification, first article and approved source records are asked about for years. Answering from approved entries means the answer matches the file.
Security procedures
The plan, and the practice
A system security plan is only worth what people actually do. Both the procedure and its approval history sit on the entry.
Why not search
An index has no idea who is asking.
Search tools index what you already have and point at it. That is useful, and it is a different job from deciding who may receive the answer.
Relevance ranking has no view on clearance. It returns the best match for the query, not the best match the person asking is allowed to receive.
A system of record stores the approved answer itself, and the clearance is decided when the answer is made rather than at the file it came out of, and the wording it serves is the wording that was approved.
Returned word for word
“This document contains technical data whose export is restricted by United States law. Transfer to a foreign person, in the United States or abroad, requires prior authorization.”
D-455 · v3
- Drawing header Unchanged
- Supplier packet Unchanged
- AI assistant Refused
What was refused
Asked to send “needs approval first” in place of “requires prior authorization”. Rewording approved text is refused, not corrected.
Frameworks
What each framework asks.
| Instrument | What it asks of you | What we supply toward it |
|---|---|---|
| ITAR, 22 CFR Parts 120 to 130 | That technical data is released only to people authorized to receive it, and that the release is documented. | Clearance is applied at the point the answer is made, and every refusal is recorded with who asked and when. |
| EAR, 15 CFR Parts 730 to 774 | That controlled items and data are classified, and that records of transactions are kept for a set period. | Each entry keeps its versions and its approvals, so what an answer said on a given date is a lookup rather than a reconstruction. |
| DFARS 252.204-7012 | That covered defense information is safeguarded in the systems that store and move it, and that incidents are reported. | Answers are drawn from a governed store with clearance at the AI layer, rather than from an index over whatever a crawler could reach. |
| CMMC, 32 CFR Part 170 | That the practices behind your security requirements can be evidenced to an assessor. | The approval trail is kept per entry and per version, so a period is evidenced from the record instead of being assembled before the assessment. |
| NIST SP 800-171 | That access to controlled unclassified information is limited to authorized users, and that the limit is enforced. | An agent answers within the clearance of the person it acts for, and the entry records the source behind what came back. |
This table describes obligations that fall on your organization, and the evidence Cognatum produces toward them. It is not a claim of certification or conformity, ours or yours.
In practice
Can the assistant see that drawing?
Security is asked whether an assistant used by engineering can reach controlled technical data.
They map the entries, the identities and the control markings once, then run the same prompts as people with different clearances and read what comes back.
What is controlled does not appear, and a refusal is recorded with who asked and when, so a denial is explainable rather than mysterious.
They export that record for the review, instead of reconstructing it from memory afterwards.
Requests in
One assistant, one asker
- Approved disclosure language
- Current supervisory procedure
- A draft nobody has signed
- An entry retired last quarter
Served
With approver, date, version
-
Disclosure D-214 rev 6
J. Mercer · approved 2026-07-14
-
Procedure WSP-11 v4
Supervision · approved 2026-06-30
Not served
Not fetchable at all
-
Draft entry
No approval on record
-
Retired entry
Archived 2026-04-11
Common questions
What program teams ask first.
What do we show an assessor who asks how AI answers are controlled?
The record. Every entry the assistant answers from carries a named approver, an approval date, a version history, and the source it came from, and every refusal is logged with who asked. How that maps to your assessment scope is a decision for your security team.
Our drawings live in a product lifecycle system. Does this replace it?
No. Entries are drawn from the systems where work already happens, and each entry links back to the record it came from. What changes is the answer taken out of that record, which is where control is lost today.
How is a foreign person prevented from receiving technical data?
Clearance is evaluated when the answer is assembled, against the person asking. Two engineers can ask the same question and get different answers, or none, and the denial is recorded rather than silent.
Does deploying this satisfy our contract cybersecurity clauses?
No, and we will not say otherwise. Those clauses attach to your systems and your practices. What you get is evidence toward them: a bounded, approved knowledge store, clearance at the AI layer, and a change history somebody can read.
A specification was superseded mid-program. How does the old answer stop?
The moment the new entry is approved it is what the assistant serves, everywhere at once. The superseded version is archived with the dates it applied rather than deleted, because a question about last year needs last year to still exist.
Who approves an entry, engineering or the security office?
Your program decides, per class of entry. What does not vary is the mechanism: an approval is a named person and a date, and nothing is served that has not passed one.
Knowledge governed. Intelligence everywhere.
See it on your own content, in your own environment.