Governance
Governance capabilities
The full governance capability set, by pillar. Every capability can be demonstrated. Select the ones that matter to you and request a demo.
Security governance
Who can act, what they can access, and the evidence that the controls held.
| Capability | Description | Demo |
|---|---|---|
Path-based RBAC & per-identity policy Explicit authorisation on every request. Who can read, change or execute each resource is decided per path and per identity. | Explicit authorisation on every request. Who can read, change or execute each resource is decided per path and per identity. | Show me this in a demo |
Identity providers, sessions & step-up OIDC and LDAP identity providers, local accounts, managed sessions and step-up authentication for sensitive operations. | OIDC and LDAP identity providers, local accounts, managed sessions and step-up authentication for sensitive operations. | Show me this in a demo |
Vault custody of secrets Secrets are held in an enterprise vault, built-in or your own, and are never written into automation. | Secrets are held in an enterprise vault, built-in or your own, and are never written into automation. | Show me this in a demo |
Hash-chained, tamper-evident evidence ledger One audited history of every action. The chain of hashes shows the record has not been altered, and legal hold is supported. | One audited history of every action. The chain of hashes shows the record has not been altered, and legal hold is supported. | Show me this in a demo |
Access-review campaigns & cadences Reviews run on a schedule and attestations are recorded. A revoke decision opens a tracked work item for your team to action. | Reviews run on a schedule and attestations are recorded. A revoke decision opens a tracked work item for your team to action. | Show me this in a demo |
Exceptions register Every waiver is recorded, scoped and visible in one register across security and change. | Every waiver is recorded, scoped and visible in one register across security and change. | Show me this in a demo |
Estate metadata in your regulatory vocabulary Annotate your estate with core governance themes and your own x-* extensions. Every write is audited. | Annotate your estate with core governance themes and your own x-* extensions. Every write is audited. | Show me this in a demo |
Change governance
Every consequential change passes through an approval policy the platform enforces where the change runs.
| Capability | Description | Demo |
|---|---|---|
Approval-as-policy Policies on your environment paths enforce quorum and exclude self-approval. The platform holds the gate. | Policies on your environment paths enforce quorum and exclude self-approval. The platform holds the gate. | Show me this in a demo |
Change windows with audited overrides Changes run in the windows you define. Overrides are explicit, permission-checked and audited. | Changes run in the windows you define. Overrides are explicit, permission-checked and audited. | Show me this in a demo |
Fingerprinted submission exports A verifiable record of what was submitted and approved, for your CAB and your auditors. | A verifiable record of what was submitted and approved, for your CAB and your auditors. | Show me this in a demo |
Approval gates on the step tree A change or workflow pauses until the named, authorised approvers act. The decision is audited with the change. | A change or workflow pauses until the named, authorised approvers act. The decision is audited with the change. | Show me this in a demo |
Impacted-asset-owner approval A policy can require the declared owner of every impacted asset to approve. A target with no declared owner is refused at creation. | A policy can require the declared owner of every impacted asset to approve. A target with no declared owner is refused at creation. | Show me this in a demo |
Break-glass with a mandatory reason A single discretionary lever for emergencies. It is named, requires a reason, is permission-checked and is audited on every use. | A single discretionary lever for emergencies. It is named, requires a reason, is permission-checked and is audited on every use. | Show me this in a demo |
Agent governance
AI operators are supervised by default, owned by a named human and can be stopped in one action.
| Capability | Description | Demo |
|---|---|---|
Supervised by default, autonomy on evidence Trust tiers define what each operator may do per asset, environment or project. Autonomy is raised on recorded evidence and can be reversed. | Trust tiers define what each operator may do per asset, environment or project. Autonomy is raised on recorded evidence and can be reversed. | Show me this in a demo |
Named accountable human owner Every AI operator has a named human owner, and every action is attributable to both. | Every AI operator has a named human owner, and every action is attributable to both. | Show me this in a demo |
Server-side transcripts with redaction What each operator saw, decided and did is recorded server-side, with redaction. | What each operator saw, decided and did is recorded server-side, with redaction. | Show me this in a demo |
Rate & budget caps Budgets are action counts. A runaway operator is limited to a bounded, audited event. | Budgets are action counts. A runaway operator is limited to a bounded, audited event. | Show me this in a demo |
Emergency stop Stop one operator, a group or the whole fleet immediately. A reason is required, the stop is audited and the control is protected by step-up authentication. | Stop one operator, a group or the whole fleet immediately. A reason is required, the stop is audited and the control is protected by step-up authentication. | Show me this in a demo |
Model key custody Model credentials are held in the operator deployment you own. The platform does not hold them. Hosted and local models are both supported. | Model credentials are held in the operator deployment you own. The platform does not hold them. Hosted and local models are both supported. | Show me this in a demo |
Signed releases & promotion Operators ship as signed releases and are verified at enrolment. Promotion to production is held for human approval in the same approval funnel. | Operators ship as signed releases and are verified at enrolment. Promotion to production is held for human approval in the same approval funnel. | Show me this in a demo |
Trust ceilings: type & classification AI operators ship capped at the supervised tier. Assets your classifications mark as critical can impose their own cap. The most restrictive ceiling applies. | AI operators ship capped at the supervised tier. Assets your classifications mark as critical can impose their own cap. The most restrictive ceiling applies. | Show me this in a demo |
The bundled OpsChain SME A working Digital SME is included. It answers product questions from version-matched, entitlement-gated documentation, and every estate read runs under the asking user’s own authority. | A working Digital SME is included. It answers product questions from version-matched, entitlement-gated documentation, and every estate read runs under the asking user’s own authority. | Show me this in a demo |
The underlying platform
The governed control plane that the capabilities above run on.
| Capability | Description | Demo |
|---|---|---|
Declarative workflows & actions Declarative workflows and actions are versioned, reviewed and governed like code, with typed inputs, conditions and fan-out. See the Platform page. | Declarative workflows and actions are versioned, reviewed and governed like code, with typed inputs, conditions and fan-out. See the Platform page. | Show me this in a demo |
Orchestration, observability & analytics One control plane across cloud, on-premise and hybrid environments, with live logs, events and a queryable history. | One control plane across cloud, on-premise and hybrid environments, with live logs, events and a queryable history. | Show me this in a demo |
A demo of the capabilities you need
We run the capabilities you select on a live governed change, including approvals, operators and the audit lane.