The existing control core makes server-side policy decisions and records redacted workspace, work order and security events. The next expansion packages will add a central AI inventory and approval centre.
The planned governance register will enforce server-side authorisation: only authorised roles will be able to create, edit, approve, or archive entries.
Name, purpose and model route
In preparationResponsible person and workspace
In preparationProcessed data and permitted boundaries
In preparationCriticality and human control measure
In preparationReview date and document references
In preparationDraft, reviewed, approved or archived
In preparationThe policy decision evaluates workspace, role, data class, sovereignty mode, model route and permitted tools. The browser cannot set or bypass these approvals.
“Confidential data only through a route permitted for the workspace.”Data class + route“External models only after provider review and approval.”Provider + workspace“Block shell and connectors for restricted data.”Tool + data class“Critical outcomes require human review.”Risk + approvalPolicy, workspace, work order and security events are recorded without placing prompts, credentials or raw content in the audit trail. A filterable interface and approval workflows will be added in expansion package 2.
Workspace, role and work order.
RedactedDecision on route, policy and tool limits.
RedactedData class and applied sovereignty mode.
RedactedBlock, approval or revoked permission.
Redacted