Governance overview

Axec governance applies controls to authority that already exists. It never creates a Connection, Grant, capability, scope, or credential source.

Enforcement order

flowchart LR
  A[Admit live authority] --> P[Evaluate action policy]
  P -->|deny| X[Record denial]
  P -->|step_up| H[Freeze ActionRequest]
  H --> R[Identical authenticated retry]
  P -->|allow| D[Record dispatch intent]
  R --> D
  D --> U[Execute upstream]
  U --> L[Apply Data Protection]
  L --> E[Retain safe result and evidence]
  E --> C[Deliver to client]

This sequence matters. Approval does not execute an action, and Data Protection does not inspect or change the upstream request. Axec records the decision and dispatch boundary before contacting the upstream service, then sanitizes a bounded response before retention or delivery.

Operational workflow

1. Confirm the Application, principal, Connector, Connection or attachment, scopes, and capability form valid live delegated or autonomous authority.
2. Add narrowly targeted authorization policy where the base authority needs a deny or human step-up.
3. Configure an approval flow for each step_up rule.
4. Add Data Protection to mediated result surfaces that may return sensitive values.
5. Use evidence and receipts to investigate decisions and outcomes without exposing credentials or raw payloads.

All controls fail closed at their trust boundary. An incomplete policy evaluation blocks execution; an unavailable matching detector withholds the unsanitized result.