Governance
Governance enforced by the platform
Every actor acts under an explicit authorisation. Every consequential change passes an enforced approval policy. Every automated actor operates inside a tiered trust grant earned through evidence. All of it is recorded in one audit lane.
These are the statements a regulator expects an operator to be able to make. OpsChain backs each one with a specific platform mechanism and keeps the evidence in one tamper-evident history.
Four requirements, four platform mechanisms
Each requirement is met by a specific mechanism that the platform enforces at run time.
“…every actor acts under an explicit authorisation”
Identity and authorisation
Path-based RBAC and per-identity policy assignment determine who can read, change or execute each resource. The decision is enforced on every request.
Enterprise identity providers (OIDC and LDAP), local accounts, managed sessions and step-up authentication for sensitive operations.
“…every consequential change passes an enforced approval policy”
Approvals on the execution path
Approval policies bound to your environment paths enforce quorum and exclude self-approval. The platform holds the gate, named approvers release it, and the decision is recorded in the same audited history as the change.
Change windows with explicit, permission-checked and audited overrides. Fingerprinted submission exports record what was approved.
“…every automated actor operates inside an earned, tiered trust grant”
Tiered trust with an emergency stop
Every automated actor, scripted or AI, starts at the supervised trust tier. Autonomy is granted on recorded evidence. An emergency stop halts one operator, a group or the whole fleet immediately, with a required reason, and the stop is audited.
Each AI operator has a named accountable human owner and operates under the same identity, approval and audit controls as your staff.
“…all of it lands in one audit lane”
One audited history
A complete audited history of every change: who requested it, who approved it, what ran and what the result was. The history is queryable in one place.
The evidence ledger is hash-chained and tamper-evident. It supports legal hold, sealed verified archives, auditor export and live streaming to your SIEM, and verification shows the history has not been altered.
Security governance
Security governance covers who can act, what they can access, and the evidence that the controls held. OpsChain enforces authorisation on every request, keeps secrets in vault custody (built-in or your own vault) and maintains the evidence record your reviews draw on.
Path-based RBAC, per-identity policy assignment, step-up authentication and managed sessions.
Secrets are held in an enterprise vault, built-in or your own, and are never written into automation.
A hash-chained, tamper-evident evidence ledger with legal hold, sealed verified archives, auditor export and SIEM streaming. One audited history of every action.
Access-review campaigns run on a schedule and attestations are recorded. A revoke decision opens a tracked work item for your team to action. OpsChain does not remediate on its own.
An exceptions register. Every waiver is recorded, scoped and visible in one register for the whole estate.
For the CISO
The difficulty is seldom a missing control. It is proving that the control held every time, across every team and tool. OpsChain provides one enforcement point and one tamper-evident history to draw that proof from, so evidence does not have to be reconciled across many pipelines. It supports the evidence you take to your regulator. It does not make you compliant by itself.
Change governance
Every consequential change passes through an approval policy that the platform enforces. The policy is bound to the path where the change runs, so execution cannot diverge from the approval.
Approval as policy on your environment paths. Quorum is enforced and self-approval is excluded by the platform.
Change windows, with overrides that are explicit, permission-checked and audited.
Fingerprinted submission exports give your CAB and your auditors a verifiable record of what was approved.
Approval gates on the step tree. A change pauses until the named, authorised approvers act.
Impacted-asset-owner approval for the highest-impact changes, and a break-glass procedure for emergencies. Break-glass is a single named lever, and every use is audited.
For the CAB owner
OpsChain does not replace your change process. It enforces that process where the change runs. An approval becomes a gate held by the platform instead of a ticket state that execution can drift away from. Your CAB keeps its cadence and its tooling. OpsChain supplies the enforcement and the submission evidence.
Agent governance
AI operators are governed in the same way as your staff. They are supervised by default, owned by a named accountable human, and operate under the same identity, approval and audit controls. Autonomy is raised on recorded evidence and can be halted in one action.
Supervised by default. Autonomy is a decision made on evidence, scoped per asset, environment or project, and reversible.
A named accountable human owner for every AI operator.
Server-side transcripts of what each operator saw, decided and did, with redaction of sensitive values.
Rate and budget caps (budgets are action counts) limit a runaway operator to a bounded, audited event. An emergency stop halts one operator, a group or the whole fleet immediately, with a required reason, and the stop is audited.
The model and provider are disclosed. Keys stay in your custody. Models can be hosted or local.
For the platform lead
Platform teams are asked to adopt AI in operations and to guarantee that it cannot run out of control. OpsChain supports both. Operators scale inside boundaries the platform enforces. Every action is attributable to an operator and its human owner. If something looks wrong, the operator can be halted first and investigated afterwards, without taking the platform down.
In your regulator's language
No platform makes you compliant. OpsChain enforces the controls and produces the governed history that your compliance evidence is built from, using the vocabulary of your obligations. You can annotate your estate with metadata in your regulatory vocabulary, using core governance themes and your own x-* extensions, and every write is audited.
CPS 230 / CPS 234
APRA-regulated banking & financial services
Operational resilience and information security standards require controlled change and evidence that tolerances are met. OpsChain supports that evidence with enforced approvals and one audited history.
OpsChain for Banking & Financial Services →SOCI / CIRMP
Critical infrastructure operators
Risk management programs require governed operational change across critical assets. OpsChain supports CIRMP evidence with explicit authorisation and a complete change history.
OpsChain for Utilities & Energy →SOCI / TSSR
Telecommunications carriers
Security obligations across 5G, IMS and hybrid networks require consistent change governance. OpsChain supports TSSR evidence across every network domain from one control plane.
OpsChain for Telecommunications →Governance in a live demo
Review the full capability list, then ask us to demonstrate any of it on a live change, an approval, an AI operator or the audit lane beneath them.