- Approval recorded
- G4 Deployment, passed, one condition due
- produced
- Permitted to run now
- not permitted
- produced
- Reason
- what runs today differs from what was approved at G4, since 2026-10-15
- produced
How it works
Every AI decision on record, from design to retirement.
Five gates, one named approver at each, evidence hashed at the moment of passage, and a chain an examiner verifies without us.
Every capability on this page is a design commitment, and every record shown is an example on a fictional institution.
Check it yourself: the verifier passes the sample pack and fails the same pack with one record changed, offline, with no account.
The five gates
G1 to G5, each with one named approver.
A gate passes when one named person signs it with the evidence attached. Never a committee. A committee may advise; the record names who decided.
- Gate record, one named approver
- Evidence hash, captured before the decision
- Chain link to the record before
| Gate | Name | What the record holds | Approver at Nebula Mutual |
|---|---|---|---|
| G1 | Data and design | Intended use, data lineage, the tier and the supplier records the system depends on | Data lead, Nebula Mutual |
| G2 | Validation | What was tested, what was not (the unexamined set), and the bounded permission with its expiry | A validator who is not the G3 approver |
| G3 | Approval | The decision to approve, its conditions and its expiry | CRO, Nebula Mutual |
| G4 | Deployment | The rollback plan and the signed approval token | CRO, Nebula Mutual |
| G5 | Operation | Monitoring series paired with their guardrails, re-assertion dates, and retirement when it comes | Actuary, model owner |
Approval and execution
Approved is one answer. Permitted to run is another.
Every system carries two answers. Was it approved? Is it permitted to run right now? A signed gate answers the first. The second compares what runs today with what was approved. When they differ, the record says so plainly.
The record chain
Each record carries the hash of the one before.
Records are appended, never edited. A new version carries a reason, an author and an effective date. Change one byte of history and every later hash stops matching.
The chain is anchored on a cadence to an outside anchor operator, so even we cannot rewrite it quietly.
typed entered by a personproduced written by the system
- Gate
- G3 Approval, passed with condition
- produced
- Approver
- CRO, Nebula Mutual, signed with key cro-nm-01, Ed25519; token GT-2026-0371
- produced
- Condition
- Attach the vendor model card from Corvane before G4.
- typed
- Evidence
b3e801a0c541… show full hash
b3e801a0c54134edfd58c0786de66e97dbb54b68a330e3aae6f7dc55a140b43a- produced
- Previous record
03209be757bc… show full hash
03209be757bc8e8e595bd9cb7e01c5493833b92413cfcf6730e3ea75c974e12a- produced
The Boundary Gateway
We can enforce. We always evidence.
The gateway sits inside your boundary in one of three modes, set per boundary by a named authority: watching only, watching and flagging, or in the path, where it can allow, escalate or block. In every mode it writes one declaration per call, a signed receipt. The receipt is written beside the call, so writing it adds no wait. When the gateway sits in the path, the delay it adds will be published once it is measured.
- Your systems
- Boundary Gateway
- Written by the system
- Evidence log
- Examiner
The refusal engine
"None issued" is a value, with a date.
When a regulator has issued nothing on a question, the record does not go blank and does not guess. It reads "none issued", in red, with the date it was checked.
When a later corpus release names an instrument, the records that cited the row are reopened for review.
- Jurisdiction
Canada, federal- typed
- Instrument
- Statute governing AI systems: none issued, checked 2026-10-11
- produced
- Checked
- 2026-10-11
- produced
- Next check
- on the next corpus release
- produced
The regime profile
Three questions decide what applies.
- Where are you supervised?
Jurisdiction, down to the province or state.
- What are you?
Sector and line of business: a life insurer, a credit union, a bank with a Sharia board.
- What do you answer to?
The regimes, as chips. Nebula Mutual answers to OSFI E-23 and the AMF AI guideline.
The answers are versioned facts with a reason. They drive the rows you see, the tiers, the packs, the informative crosswalks and the exports.
The evidence pack
A quarter, in one file, verified offline.
Choose the systems and the period. The pack holds the records, the evidence hashes, the chain segment, the anchors and a signature. The examiner runs the verifier, published under Apache 2.0, without an account and without us.
A consistent chain of false records verifies perfectly. The chain proves integrity; the institution proves truth.
What the pack contains
- A one-page summary for a board: systems, gates, approvers, lapses
- Records in the GovernanceOS schema
- The same records as flat JSON and CSV with an embedded dictionary
- Evidence hashes and timestamps
- The chain segment and its anchors
- The pack signature and the verifier version
Plain words
The terms on this site, in one line each.
- Gate
- A sign-off point in a system’s life: G1 data and design, G2 validation, G3 approval, G4 deployment, G5 operation.
- Named approver
- One person who decides at a gate. A committee may advise; a board resolution is recorded with its number and signed by its chair.
- Typed and produced
- Typed: entered by a person. Produced: written by the system from what actually happened.
- Refusal
- The record’s answer when a regulator has issued nothing: “none issued”, with the date it was checked.
- Declaration
- A signed receipt for one AI call, chained to the one before it.
- Chain and anchor
- Each record carries the hash of the one before; the latest hash is published to an outside anchor operator, so history cannot be rewritten quietly.
- Evidence pack
- A file holding records, hashes and a signature, checked offline with an open-source verifier.
- Deposited, DOI-cited specification
- A published standard with a permanent reference number; every record field points to the line it comes from.
- MCP
- The open protocol that lets assistants such as Claude or Copilot read records, with a person confirming every change.
- Tenant
- Your institution’s private space in GovernanceOS, with its own encryption key.
- VPC
- GovernanceOS running in your own cloud account, in your region.
- Hot path
- The route an AI call takes while someone waits for the answer. Receipts are written beside it, never in its way.
- Reopened for review
- Sent back for another look because a regulation row it cites changed.
- Four altitudes
- The four areas the readiness check looks at: Regulatory Floor, Strategic Compass, Operational Machinery and Technical Substrate. A position, never a score.
Check the records yourself.
Run the open verifier on the sample pack, offline, with no account. Or book thirty minutes on your regime and your gaps.