§ governance

A confidence score is not a control.

Declare the policy, replay it on last quarter, ship it, reverse it if you must. Your risk team follows the thread from the rule to the cash in fewer clicks than approving an expense report.

role-based access · default roles · 6 roles
§ 01 · policy › simulate › ship › reverse

Four steps, all reviewable.

Each step leaves a record the next reviewer can read. Nothing happens that a person could not have seen coming.

01

Declare

Write the outcome, the autonomy budget, and the guardrails into a signed, versioned policy file. Diffable in a pull request.

02

Simulate

Replay the policy on last quarter's real transactions. See the cash and the risk before a single customer is touched.

03

Ship

Go live in suggestion mode, the agent drafts, a human signs. Autonomy widens only as the accept rate earns it.

04

Reverse

Inside the window, one signed reversal unwinds the action and posts the credit. The original and the reversal both stay on the ledger.

§ 02 · architecture

Every action passes through four gates before it posts.

A high-level view of the request path in production, authenticated, policy-checked, executed, logged.

INBOUNDuser / apimTLS · OIDC · passkeyGATE 01auth & scope• authenticated request• scoped to your tenant• read/write limited to AR• session trackingGATE 02policy• autonomy budget check• two-person attestation• human-in-loop on breach• fail-closed on missingGATE 03action• outreach · match · credit• scoped credentials• retry with backoff• logged before commitGATE 04ledger• immutable entry• reversal, not edit• actor · timestamp · outcome• CSV + JSON exportSYSTEM OF RECORDsap · netsuiteoracle · your GLGATES FAIL-CLOSED · ACTIONS LOGGED BEFORE COMMITEU-HOSTED OR ON-PREM · DATA SCOPED TO TENANT30-DAY REVERSAL WINDOW · CREDIT NOTE ON UNDO
§ 03 · primitives

Built in, not bolted on.

Governance that is added after launch is theatre. These are load-bearing parts of the platform. You cannot ship an agent without them.

Autonomy budgets

Every rule runs under a spend cap in euros or count. Exhaust it and the rule circuit-breaks to a human.

Two-person attestation

Revenue-material actions need two signatures before they post. Default on; configurable downward only.

Reversibility windows

Every action carries a redo path. Confidence comes from undo, not from a probability score.

Policy-as-code

Signed, versioned, PR-reviewable. Any change that widens blast radius needs two approvals.

Immutable audit trail

Every action is logged and can't be edited after the fact, only reversed with a matching credit. Tenant-scoped, exportable to your GL.

Data residency, your choice

Self-hosted in your environment, or EU-hosted by us in the region you choose, with your own encryption keys (BYOK). Model calls pinned in-region either way. Your data never trains a foundation model.

§ 04 · posture, stated plainly

What is in place today, and what is not yet.

Kaiva is pre-launch and working with a small design-partner cohort. Rather than imply certifications we do not hold, here is the honest position, your procurement team can plan around it.

in place today
  • EU-hosted or on-prem, single-tenant isolation
  • Immutable audit trail with role-based access
  • Bounded autonomy, HITL, and reversibility by construction
  • DPA and sub-processor list on request
not yet
  • SOC 2 Type II, in progress, not certified
  • ISO 27001, planned, not audited
  • Penetration-test report, first engagement scheduled
  • Public status page, pre-launch
bring your reviewers

Bring your risk function to the first call.

We would rather answer the hard questions on day one than paper over them in a pilot. Come with your worst case.

Scope a pilot →