GUARD
A system this capable must be constrained
Governance is not a policy document beside the platform. It is a runtime component every read, every write and every agent step passes through, and it leaves an append-only record behind.
01
Policy as code
REQUEST
who <user, role, unit, clearance>
what <object, property, classification>
why <declared purpose>
when <time, context>
|
POLICY ENGINE
|
+----+----+
| |
ALLOW DENY / MASK
| |
+----+----+
|
AUDIT RECORD (append only)Access depends on the declared purpose, not only on the role. The same analyst may read a phone number for a fraud investigation and be denied it for general browsing.
02
Immutable audit
AUDIT ENTRY actor <user or agent> action read | write | export | dispatch target <object id> purpose <declared purpose> policy <rule id that permitted it> result allowed | masked | denied timestamp <utc> signature <hash chained to previous entry>
03
Data protection commitments
minimise
Minimisation
Domains link through CORE identifiers; sensitive detail stays in the owning system and is fetched only under an approved purpose.
retention
Retention
Every dataset declares how long it is kept and what happens at expiry. Expiry is enforced by the platform, not by a reminder.
residency
Residency
State data can be pinned to national infrastructure; the deployment model is a governance decision, not a vendor default.
review
Independent review
The audit log is readable by an oversight body that cannot be blocked by the operating agency.
04
What this platform will not do
No scoring of private individuals
There is no general behavioural score for citizens. Risk models apply to procurement, contracts and institutional processes.
No covert collection
Sources are registered and their existence is inspectable. The platform ingests institutional records and lawfully available information.
No automated penalty
Model output is a question put to an official. It is never itself a sanction, a payment block or a legal finding.
No unexplainable answer
If a result cannot be traced to sources and a named method, it does not ship to a decision screen.