Every high-impact decision has a name behind it.

Human approval gates and governance structure

High-impact, ambiguous, or exception-triggering actions require explicit human review and approval before execution. Reviewers are assigned per overlay based on sensitivity, jurisdiction, and operational context — typically executive sponsors, compliance officers, IT/security leads, and operational reviewers.

• Approval-gate assignment. Named reviewers per overlay, scoped to sensitivity and jurisdiction.
• Multi-stage review workflow. Cross-border transfers, policy exceptions, emergency overrides, and cryptographic migrations pause at review gates.
• Rationale documentation. Every approval, denial, or modification is accompanied by a recorded reason; reviewer identity, timestamp, and policy state are logged.
• Cryptographic signing. Approvals and exception workflows are cryptographically signed and chained to an immutable evidence ledger.
• Exception and rollback. Denials and reversals invoke rollback procedures where supported and capture supporting evidence for post-hoc review.
• Continuous oversight. Quarterly assurance reviews and periodic audits analyze exception frequency, approval latency, and rollback events.
• Beneficiary control. The beneficiary organization retains ultimate authority over approval chains, evidence access, exception thresholds, and operational continuity. All governance boundaries are documented and reviewable.

The ECIA-7 review workflow

Consequential actions pass through seven checkpoints. Each checkpoint is a documented decision — not an automated pass-through — and is recorded on the evidence chain.

1. Gate 1
   Eligibility
   Is the requester authorized for this class of action at all?
2. Gate 2
   Classification
   What is the sensitivity and jurisdiction of the data or system in scope?
3. Gate 3
   Intent
   What is the stated purpose, and does it match the requested action?
4. Gate 4
   Approval
   Which named reviewer(s) must sign; do they have the standing to sign?
5. Gate 5
   Action
   Bounded execution with least-privilege scope and, where supported, a rollback token.
6. Gate 6
   Evidence
   Immutable record of decision, rationale, signatures, and outcome linked into the chain.
7. Gate 7
   Audit
   Periodic sampling, quarterly assurance reviews, and metric analysis of gate performance.

What the evidence chain produces

A composed suite of outputs is engineered for institutional accountability, regulatory alignment, donor assurance, and incident reconstruction. Outputs are cryptographically signed, immutable, and exportable for audit, board review, or funder reporting.

• Decision records. Reviewer identity, timestamp, rationale, policy version, and outcome.
• Exception ledgers. Every override, denial, and reversal with linked justification and rollback state.
• Cross-border transfer logs. Jurisdictional context, classification, and approval chain for each movement of data.
• Cryptographic migration records. Algorithm changes, key rotations, and phased-migration checkpoints.
• Assurance metrics. Approval latency, exception frequency, rollback usage, and gate-effectiveness trend data.
• Evidence packs. Composed bundles for board, funder, regulator, or incident-response review.