Governance and Compliance Center¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Filled 2026-10-09
This page was empty. It maps onto the final-state Human Review Center and Security Center modules and the prototype's Human Reviews and Governance destinations. Requirements: FUX-05 (exact-version decisions with authority, expiry and conflict handling), FUX-10 (evaluation evidence tied to the candidate), FUX-12.
Review inbox¶
| Element | Shown |
|---|---|
| Request | Run, step, the exact artifact or action version (hash), release and snapshot, policy revision, eligible approver rule, expiry |
| Evidence | Proposed outcome, source citations, validation results, risk and policy basis, evaluation evidence for the candidate; an explanation may assist, a confidence score grants nothing |
| Decision | Approve, reject, request changes; recorded with actor, time, reason and concurrency version; one valid decision per request |
| Consequences | Resulting run state shown as a separate observation; stale, expired, conflicting or wrong-scope decisions explained |
| Bulk | Per-item eligibility and outcomes if offered |
Decisions are commands to Run Control (approvals); approval policy (routing, separation of duties, expiry) comes from Trust & Operations (plane).
Policy and audit¶
- Policy definitions and their revisions; where each applies (tenant, project, agent, environment, tool, task); simulation results when available.
- Recorded policy decisions per invocation with the revision used.
- Audit evidence: append-only, with export scope and retention per classification; redacted views for observers.
- Compliance reports and findings as Trust & Operations provides them; frameworks are applicability reviews, not claims.
Current implementation¶
No approval aggregate, policy engine or audit store exists; the prototype's review actions display a toast claiming an audit event and workflow resume. Label: Simulated.