Trust that keeps its context.

A freelancer hires a studio; the studio hires a freelancer; both directions are equally normal, recursively. Buyer and seller schemas hard-code asymmetry into tables, permissions and interfaces, and cannot represent a chain four levels deep — so KeizAI's model has one Actor abstraction for person and company, and commerce is an engagement with a direction, not a role type. Nothing in the schema privileges one side.

The same discipline applies to language. The specification maintains a list of words the product refuses, because each one smuggles in a model of people the product rejects.

When a person puts a candidate forward, they choose the weight of their own name behind the act — from "I know them; you should talk" to "I remain accountable for delivery". The upper levels are not decoration: a delivery responsibility creates an accountability link, and the parent role cannot complete while the work it stands behind is unfinished.

A nomination is always a person's act — an AI agent can propose a candidate, but can never nominate. Once made, its author, its level and its statement are immutable; a change of mind is a visible withdrawal and a new nomination, not an edit. And when a nominee declines, the reason is a closed set — available to the nominator without ever leaking a private judgement.

The nominee is a peer in the act too: they may accept, counter, or offer to fill an entire branch and bring their own people or company.

Privacy here is structural, not procedural — enforced by what can exist, not by what is filtered. A relationship you chose not to disclose is designed to be undetectable: no count changes, no gap appears in an ordering, no page runs short, no response is measurably slower, and no interface ever shows a "results hidden" notice. A hidden thing and a nonexistent thing look identical, in bytes and in time.

A private judgement — "don't suggest this person to me" — is unreachable rather than filtered: it feeds no search index, no projection, no export, no AI prompt, and its subject can never encounter it. Yet it never blocks anyone: a colleague may still nominate that person, no warning fires, and excluding someone from a project requires a visible, attributable veto instead. Influence is private; authority is public.

Explanations obey the same rule. A candidate's explanation may only cite facts the viewer is authorised to see; where the only evidence is a hidden relationship, the system says less or nothing — it never fabricates a collaboration, and it never says "hidden reason", which would itself disclose. Even a vague reason is a disclosure, so there is deliberately no generic "strong fit" fallback.

KeizAI computes no global reputation for anyone. There is no field named score, rating, rank or match in the domain model, and where every other design trade-off carries a measured trigger for revisiting, this one's trigger reads: never. A global number collapses contextual taste into a gameable metric and turns private judgement into published claims about people.

Instead, trust stays typed, owned and scoped: who asserted what about whom, for which kind of work, visible exactly as far as its author chose. The default for every human-authored judgement is private to its author. Sharing it with its subject is always permitted and encouraged; making it public requires the subject's own revocable consent, because publishing a claim about a person is publication.

The design is honest about limits: narrowing visibility stops future disclosure but recalls nothing already seen, the record of who worked together survives archiving — because the graph, not the coordination, is the durable asset — and trusted circles can reproduce bias, which the charter names as a risk to govern, not a problem it pretends to have solved.