Orcher is the agentic control plane for critical work. It unifies governance, cost-disciplined intelligent routing, strict enterprise data boundaries, elastic compute, and role-scoped authority — enforcing every directive end to end and compounding Dipp Intelligence with each verified execution, towards enterprise superintelligence.
Orcher across your systems of record
Fig. A
Guided walkthrough
How Orcher connects to your systems of record
Select any node to read how it participates. Orcher is the control plane that makes enterprise autonomy governable: scope, identity, policy, evidence, enterprise data boundaries, cost and observability are enforced together, so agents can act at machine speed inside boundaries the enterprise sets — and nothing reaches a system of record until every one of those controls clears.
Source: Vol. I, p. 13 — How Orcher delivers HITRFigure · Orcher™
The trust gap, measured
FIG. HOME-03
One Verified Execution Cycle
Fig. VEC-01
Input
IN.A
Directive
Intent issued by a named professional, not an anonymous prompt.
IN.B
Context
Systems of record, policy, and entitlements resolved at request time.
Control plane · Orcher
C1
Role Identity Fabric
Binds the directive to the role and its cryptographic authority.
C2
Logic Scrubber
Verifies the proposed action against records before commit.
C3
Data Control Gateway
Data boundary, redaction, and egress rules enforced in path.
No model executes until the role, the logic, and the data boundary all clear.
Output
OUT.A
The action
Executed under a named human's authority, at machine speed.
OUT.B
Dipp Intelligence
The verified execution path, retained by the enterprise.
What we do
Policy stops being a document and becomes an executable gate. Each proposed action is checked against your systems of record — eligibility, licensure, limits, jurisdiction — and the cycle halts before anything partial is written. What commits is hashed into an immutable audit record.
Explore ComplianceA hard perimeter around enterprise data: the enterprise data boundary enforced per directive, sensitive fields masked before they reach a model, and contractual no-training guarantees on every provider path — so using frontier models never means donating your data to one.
Explore Data controlEconomic ceilings bound autonomy before spend runs away, and one observability view covers every model, framework and agent in flight. Scope, identity and entitlements are enforced at execution rather than requested at review.
Explore Cost and controlOrcher · seven components
Four sequential gates decide whether an action may commit. Three continuous controls hold data, cost and visibility while it runs. Each is a separate component with its own contract and its own evidence.
The components are specified end to end in The Enterprise Superintelligence Report, Vol. I.
The strategy
Binding a platform to one heavy frontier model wastes tokens and leaks proprietary data. Dipp AI's strategy — and the reason Orcher's seven components exist — is intelligent routing: decouple orchestration from any single provider, match each task to the cheapest model that can carry it, and keep prompts and data inside the enterprise's own tenant boundary.
Switch providers in a week, not a quarter.
An orchestration layer sits in front of every AI task rather than inside one vendor's SDK. Directives, roles, policy and evidence live in Orcher, so a provider change is a routing-table change — a week of work rather than a quarter of re-platforming — and no model vendor becomes the system of record for how the enterprise operates.
The protocol stackRoughly 90% of workloads never need the frontier.
Cost Governance routes by the stakes of the action rather than the habits of the developer. Standard, routine queries — roughly nine in ten workloads — go to cheaper open-weight or small in-house models; expensive frontier models are reserved for genuinely complex, high-reasoning tasks. Across 400-plus models and 70-plus providers the price spread is 4,500× (Vol. I, p.25), so the routing decision is the economics.
Cost GovernanceProviders never learn from your interaction data.
The Data Control Gateway forces data and prompt histories to stay inside the company's own cloud environment — a private tenant, in-region — and verifies training exclusion and the data boundary on every call before a token leaves. Using frontier capability never means donating enterprise interaction data to the firm that sells it back.
Data Control GatewayInteractive · routing simulator
Each workload type carries a different level of stakes, sensitivity and reasoning depth. Select one to see which Orcher component owns the decision, which model class it routes to, which gates run, and what that does to tokens and cost against a frontier-default baseline.
Workload type
Routing decision
High-volume intake: label the document, extract identifiers, route it to a queue. No irreversible write, no judgement call.
Decided by
Cost GovernanceRouted to
In-house small model
Runs inside the tenant. No egress, lowest unit cost, deterministic latency.
Token reduction
42%
1,800 → 1,044 tokens
Cost per directive
$0.00013
baseline $0.0432 on frontier model
Cost saving
100%
2360ms faster median
Gates that run before commit
Stays inside the tenant entirely — the payload never reaches an external provider.
Indicative class prices per 1M tokens: In-house small model $0.12 · Open-weight mid model $0.60 · Commercial mid-tier $4.50 · Frontier model $24.00. Illustrative only; the 4,500× spread across 400+ models and 70+ providers is from The Enterprise Superintelligence Report, Vol. I, p.25.
Interactive · economics
A frontier-default estate pays the top price band for every workload, including the nine in ten that never needed it. Move the inputs to your own volumes and see the token waste removed and the cost impact of the routine-versus-frontier split.
Your estate
One directive is one verified execution cycle.
Prompt plus completion, before scoping and redaction.
Directive scoping, field redaction and cache reuse before a model is called.
Your blended frontier rate.
In-house or open-weight class hosted in your tenant.
Estimated impact
Monthly cost, frontier default
$30.0K
1.25B tokens at the top band
Monthly cost with routing
$2.5K
$459 routine · $2.0K frontier
Token waste removed
400.0M
32% of 1.25B never reaches a model
Cost reduction
92%
$27.5K per month
Annualised
$330.0K
Retained by routing 90% of directives to a routine class and reserving the frontier for the 10% that genuinely needs it — with every routing decision hashed into the same audit chain as the action it paid for.
Estimates only, for planning conversations rather than contract terms. The 4,500× price spread across 400+ models and 70+ providers, and the 68% of AI programmes running over budget, are from The Enterprise Superintelligence Report, Vol. I (pp. 25, 9).
Proof points
Dynamic model routing is only a strategy if it moves numbers a finance team and an auditor both recognise. These are the outcomes it is accountable to.
Cost
4,500×
price spread across 400+ models and 70+ providers
The spread between the cheapest sufficient model and the frontier default is the entire economic case for routing. A directive sent to the wrong class does not fail — it just costs orders of magnitude more than it had to.
Vol. I, p.25
Token waste
~90%
of workloads never need a frontier model
Routine classification, extraction, summarisation and drafting clear on in-house or open-weight classes. Reserving frontier capacity for genuinely complex work is what turns AI spend from a run-rate into a budget.
Dipp AI routing model · Vol. I, p.25
Budget
68%
of enterprise AI programmes run over budget
Overrun is a control failure, not a forecasting failure. Cost Governance applies a ceiling per role and per directive and halts loops at the step boundary rather than at the invoice.
Vol. I, p.9
Latency
10×
faster on routine classes than a frontier default
Cheaper classes are also materially faster. Routing the routine nine-tenths off the frontier shortens the median directive as a side effect of the economics.
Indicative class latencies, Orcher routing table
Auditability
28%
of enterprises can trace an agent action end to end today
Every routing decision Orcher makes — class chosen, alternatives considered, ceiling applied, boundary attested — is hashed into the same evidence chain as the committed action, so the economics are as auditable as the outcome.
Vol. I, p.6
Portability
1 week
to change providers, not a quarter of re-platforming
Because orchestration is decoupled from any vendor SDK, a provider change is a routing-table change. Directives, roles, policy and evidence stay in Orcher.
Dipp AI protocol stack contract
78%
of enterprises run agents in production
Vol. I, p.2
28%
can trace an agent action end to end
Vol. I, p.6
144:1
non-human to human identities
Vol. I, p.11
54%
have already had an agent-related incident
Vol. I, p.2
Pioneered at Dipp AI · 1 of 8
Human-in-the-Role is the first of eight primitives we defined — and it only works because the other seven exist. A loop asks a tired person to approve a plausible action in thirty seconds. A role binds authority, scope, data, spend and evidence to the professional who answers for the outcome, enforced at execution rather than requested at review.
Figure · Orcher™
Human-in-the-Loop versus Human-in-the-Role
FIG. HOME-02
Human-in-the-Loop versus Human-in-the-Role
Fig. HITR-11
Path A · Human-in-the-Loop
Oversight requested at review. Control is a click.
L1
Agent proposes
A plausible action is generated with no scope boundary attached.
L2
Queue
The proposal joins thousands of daily alerts competing for attention.
L3
30-second review
A tired reviewer accepts under time pressure; automation bias sets in.
L4
Timeout → auto-proceed
Unattended items proceed anyway. The click was the only control.
L5
Action commits
No delegated authority, no verifiable record of why it was allowed.
Outcome — 28% of enterprises can trace an agent action end to end.
Path B · Human-in-the-Role
Authority enforced at execution. Control is structural.
R1
Directive from a role
Intent is issued inside a scoped role with declared entitlements.
R2
Authority bound
The role's cryptographic authority is attached before any model runs.
R3
Pre-commit verification
Policy, records and limits are checked as an executable gate, not a memo.
R4
Halt or commit
Out-of-authority work cannot execute — there is nothing to rubber-stamp.
R5
Hashed evidence
The full path is written to an immutable ledger and retained by the firm.
Outcome — every committed action carries provable scope, identity and evidence.
Seven components · one control plane
Dipp AI defined Human-in-the-Role and the seven components that make it enforceable. Four sequential gates decide whether an action may commit at all — directive scope, role-bound authority, pre-commit verification, hashed evidence. Three continuous controls govern enterprise data boundaries, spend and cross-provider visibility for as long as the work runs. Remove one and the guarantee collapses.
Figure · Orcher™
One control plane, two layers
FIG. HOME-01
01 · Layer 1
Plain language becomes the permanent record of what was asked.
02 · Layer 1
Binds the directive to a human and a role, cryptographically and revocably.
03 · Layer 1
Verifies the proposed action against systems of record before commit.
04 · Layer 1
Hashes the verified action permanently. Evidence, not logs.
05 · Layer 2
Training exclusion and data boundaries verified before routing.
06 · Layer 2
Routes by stakes and halts runaway loops.
07 · Layer 2
Real-time cross-provider trace: which model, which role, what cost, what outcome.
Architecture
From plain-language intent to a hashed record and a retained intelligence asset — the full schematic as published in Vol. I.
Orcher Component Schematic v1 — the directive execution path
Fig. ORC-19
Layer 1 · Accountability — sequential, halt-by-default
L0 · Entry
Directive
A professional states intent in plain language, inside a declared role.
C1 · Layer 1 · Gate 1
Directive Interface
Intent is parsed into a scoped, bounded task with explicit limits.
C2 · Layer 1 · Gate 2
Role Identity Fabric
The task is bound to accountable identity and its entitlements.
C3 · Layer 1 · Gate 3
Logic Scrubber
Policy and systems of record are checked before anything commits.
C4 · Layer 1 · Gate 4
Immutable Audit Ledger
The decision path is hashed into evidence that survives challenge.
OUT · Exit
Committed action + Dipp Intelligence
The action executes under verified authority; the record stays with the firm.
Layer 2 · Control — continuous, applied to every stage above
C5 · Layer 2
Data Control Gateway
Data boundary, redaction and no-training guarantees enforced in path.
C6 · Layer 2
Cost Governance
Economic ceilings bound autonomy before spend runs away.
C7 · Layer 2
Observability
One view across every model, framework and agent in flight.
Solutions
Turn agent activity into evidence a regulator will accept.
Route by the stakes of the action, not the habits of the developer.
Verify where data goes before it goes there.
Utilization is a governance outcome, not a procurement problem.
Authority belongs to a person and a role — never to a service account.
Industries
Orcher is built for industry — from highly regulated sectors to every other line of business running critical decisions and workflows.
The brief
How Orcher decouples orchestration from any single provider, routes each task to the cheapest sufficient model, keeps prompts and data inside your own tenant, and proves every execution — written for the security, risk, finance and engineering leaders evaluating agentic AI for production.
An agentic control plane is the layer that decides whether an AI agent's proposed action may execute at all. Orcher, built by Dipp AI Technologies, implements it as seven components: a Directive Interface that scopes intent, a Role Identity Fabric that binds the task to accountable identity, a Logic Scrubber that verifies the action against systems of record before commit, an Immutable Audit Ledger that hashes the decision path, plus a Data Control Gateway, Cost Governance and Observability that run continuously. Halt is the default outcome — nothing commits unless every gate clears.
Orcher is Dipp AI's agentic control plane for enterprise AI. It closes the trust gap between deployment and provability: 78% of enterprises run agents in production, only 28% can trace an agent action end to end, and 54% have already had an agent-related incident. Orcher makes policy executable rather than documentary, enforces enterprise data boundaries and no-training guarantees on every provider path, caps spend before autonomy runs away, and produces a hashed, replayable record of every committed action.
Layer 1 — Accountability (sequential gates): 1) Directive Interface, which turns plain-language intent into a bounded task; 2) Role Identity Fabric, which binds the task to a role's cryptographic authority and entitlements; 3) Logic Scrubber, which verifies the proposed action against policy and systems of record before commit; 4) Immutable Audit Ledger, which hashes the full decision path into tamper-evident evidence. Layer 2 — Control (continuous): 5) Data Control Gateway for data boundary, redaction and egress; 6) Cost Governance for economic ceilings on autonomy; 7) Observability for one view across every model, framework and agent.
Human-in-the-Loop asks a person to approve a plausible action inside a short review window; under volume it degrades into automation bias, ignored alerts and timeout auto-proceed, and the only artefact is a click. Human-in-the-Role, the model Orcher enforces, binds the action to the scope and authority of the professional accountable for it before any model runs, halts anything outside that authority, and writes hashed evidence of the path. Control moves from review-time attention to execution-time enforcement.
The Data Control Gateway sits in the execution path: the data boundary is enforced per directive, sensitive fields are masked before a prompt reaches any model, egress rules are applied continuously, and contractual no-training guarantees are held on every provider route. Orcher is provider-neutral, so using frontier models does not mean donating enterprise data to one.
Orcher is metered in Verified Execution Cycles — one directive carried through the full control plane — rather than per seat. Orcher is invite-only during the current deployment phase, and scope follows a technical briefing with the founding team rather than a published rate card.
Orcher is deployed across every industry, including healthcare, insurance, banking and financial services, government and public sector, military and defense, life sciences and pharma, legal services, energy and utilities, manufacturing, telecommunications, logistics, retail, automotive, education, and real estate and construction. Its evidence model is designed against obligations such as EU AI Act Article 14 human oversight, the NIST AI Risk Management Framework, and FDA clinical decision support guidance.
Dynamic model routing. First, decoupled orchestration: Orcher sits in front of AI tasks so an enterprise can switch providers within a week rather than a quarter, because directives, roles, policy and evidence live in the control plane rather than in one vendor's SDK. Second, task-to-model matching: routine standard queries — roughly 90% of workloads — are routed to cheaper open-weight or small in-house models, while expensive frontier models are reserved for complex, high-reasoning tasks; the price spread across 400-plus models and 70-plus providers is 4,500× (Vol. I, p.25). Third, private tenant boundaries: data and prompt histories are forced to stay inside the company's own cloud environment, with training exclusion and data boundaries verified on every call, so model providers cannot learn from enterprise interaction data.
Dipp AI Technologies, Inc. was founded by Odero Otieno, its CEO and CTO, previously Managing Director of Engineering for Cloud, Data, and AI Platforms at Humana — where he architected infrastructure supporting more than $130 billion in annual revenue and 20 million-plus customers across healthcare, insurance, and finance — and Principal Director of Software Engineering for Enterprise Platforms at Microsoft, where he led platform engineering for the company's top 100 enterprise customers. He pioneered Human-in-the-Role and authored The Enterprise Superintelligence Report, whose Vol. I (August 2026) documents the trust gap between enterprises deploying agentic AI and those able to prove what those agents did, sets out Human-in-the-Role as the replacement for Human-in-the-Loop review, and specifies Orcher's seven-component control plane covering authority, policy enforcement, audit evidence, enterprise data boundaries and no-training guarantees, cost ceilings on autonomy, and cross-framework observability.
Output B · Dipp Intelligence
OUT.B of the Verified Execution Cycle is Dipp Intelligence — the verified execution path, retained by the enterprise rather than absorbed by a model provider.
Path
The exact sequence that produced a verified outcome.
Role
The authority under which the action was permitted.
Cost
The model tier that actually proved sufficient.
Proof
The hashed evidence a regulator will accept.
