Governance
Security governance
Security governance covers who can act, what they can access, and evidence that the controls held. Most organisations can answer the first two questions. Few can prove the third across every team and tool. OpsChain enforces authorisation on every request, keeps secrets in vault custody, and maintains the single tamper-evident evidence record your reviews draw on.
One enforcement point and one audited history
Controls held in documents drift over time. Controls enforced on the execution path hold. Each of the controls below is enforced by the platform and recorded in the same hash-chained history.
Authorisation on every request
Path-based RBAC and per-identity policy assignment. The platform decides who can act, and on what, on every request. The decision does not depend on convention or on which pipeline holds a key.
Step-up before sensitive operations
For the operations you designate, the platform requires step-up authentication before the action can be proposed. This check comes before any approval gate and is backed by managed sessions.
Secrets in vault custody
Secrets are held in an enterprise vault, either the built-in vault or your own, and are never written into automation. Automation references a secret by name and does not carry its value.
A tamper-evident evidence ledger
Every action, approval and refusal is recorded on one hash-chained, tamper-evident history with legal hold. Any change to the record is detectable. Recovery after an incident is performed as an acknowledged, auditable re-anchor of the chain, so the repair itself is on the record.
Access reviews on cadence
Access-review campaigns run on a schedule and attestations are recorded. A revoke decision opens a tracked work item for your team to action. OpsChain does not remediate on its own.
An exceptions register
Every waiver is recorded, scoped and visible in one register for the whole estate. Exceptions are governed in the same way as the rules.
The questions your auditors ask
Who can access production? Path-based RBAC with per-identity policy. The authorisation decision is recorded with every request.
Where are credentials held? In vault custody. Automation references them and never contains them, so rotation does not require searching through pipelines.
Can you prove the history is intact? The ledger is hash-chained and tamper-evident, with legal hold. Verification shows the record has not been altered.
When did you last review access? Campaigns run on a schedule with recorded attestations, and every revoke decision is a tracked work item.
What about the exceptions? They are held in one register, where each is recorded, scoped, visible and reviewed.
OpsChain supports the evidence you take to CPS 230/234, SOCI and TSSR discussions. It enforces the controls and produces the governed history that your compliance evidence is built from.
Security governance by role
For the CISO
The difficulty is seldom a missing control. It is proving that the control held every time, across every team and tool. OpsChain provides one enforcement point and one tamper-evident history to draw that proof from, so evidence does not have to be reconciled across many pipelines. It supports the evidence you take to your regulator. It does not make you compliant by itself.
For the compliance lead
Every actor is authorised, every secret is in custody and every action is on one verifiable history. Each control is enforced by the platform, and the evidence is generated during normal operation instead of being assembled at audit time.
For the platform team
Enforcement sits in the platform and does not need to be built into each pipeline, so teams keep their tools and their speed. Access reviews and the exceptions register produce tracked work items for people to action. The platform surfaces the work and does not change your estate on its own.
Security governance in a live demo
In twenty minutes we show an unauthorised request refused, a secret used by automation without its value being exposed, the ledger verified end to end, and an access-review campaign producing tracked work items. The evidence is generated during normal operation.