Abstract
GateHouse runs a commercial network across sovereign environments without ever centralising raw data. This paper details the control-plane / data-plane split, the recursive disclosure gate, and a precise definition of what “metadata-only” means — including for GateHouse’s own telemetry and its in-container AI.
The sovereignty problem
A network needs a shared view to function — discovery, matching, benchmarking all require some common surface. But the whole value proposition of GateHouse is that raw data never leaves its owner. The architecture exists to reconcile those two facts: a functioning network whose control plane never holds the asset it commercialises.
Control plane / data plane
GateHouse adopts the well-understood control-plane / data-plane split. The data plane runs inside each participant’s environment as a container; it is where profiling, policy evaluation, workload admission and metering happen. The control plane is metadata-only: it coordinates, it never computes on raw data, and it never receives it.
The disclosure gate
Even metadata is disclosure. So metadata must pass the owner’s disclosure policy before it leaves the container — including telemetry destined for GateHouse itself. The gate is a single primitive: a policy-evaluated checkpoint that decides what may cross a given boundary, for a given audience, under given attributes.
One gate, many boundaries
The same gate primitive is applied recursively. It governs what leaves the organisation to the network, what reaches a specific counterparty, what reaches GateHouse, and — where an organisation chooses tighter internal controls — what flows from an individual container up to the organisation’s own dashboards. Any surface renders exactly what has passed the gates between it and the data.
In-environment AI
In-container agents default to an in-environment LLM, so prompts, intermediate reasoning and staged outputs never leave the boundary. Where a model-IP-protected trust branch is required, confidential-computing substrates (TEEs, remote attestation) are available — the architecture is designed to accommodate that branch without redefining the gate.
What crosses, precisely
Three classes of object cross a GateHouse boundary, and only these: a permission granted under policy; a model or workload admitted to run in place; and a computed insight that has passed the gate. Raw records are not on the list, and the boundary counter that proves it reads zero.