Govern · Compliance, audit, policy
BUILTGovern · Compliance, audit, policy
Honos. Who may decide what, on the record.
Nerio sees and proposes. Minerva acts. Honos decides who may authorize what, routes every request to that person by a versioned policy, and keeps the decision with the evidence that was in front of them. It is the part of EOS a risk committee reads.
It works on its own: your people can raise requests directly without Nerio, and without Minerva the decisions export to the systems you already run.
What it enforces
Six rules, each one a test.
| Rule | What it means |
|---|---|
| Routing is a function | The route is computed from the request and the policy version, so the same request on the same policy always goes to the same people, and a changed route means a changed policy, which the version names. |
| Every clause is named | A request carries every clause that fired, so nobody has to reconstruct why it went to Finance. |
| A named person decides | Each step records who decided, the clause, the policy version, the evidence they saw and why. |
| The wrong approver is refused | A decision from someone the step does not name is refused with 403, not logged and ignored. |
| A rejection is final | A rejected request cannot be approved afterward; a new request is raised instead. |
| An agent cannot decide | A principal may propose; only a person decides, at every step. |
The default policy
| Clause | When it fires | Step |
|---|---|---|
| spend.over.50k | amount over $50,000 | Finance director |
| spend.over.10k | amount over $10,000 | Budget owner |
| risk.high | risk marked high | Security review |
| vendor.new | a supplier not yet on record | New supplier check |
| category.legal | category is legal | Counsel |
| default | nothing else fired | Manager |
Every clause, step and threshold is yours to set; the policy is data with a version, not code.
The record and its reports
What was decided leaves as a report anyone can check.
Reports are how the record leaves the building, which is why they live here rather than on a page of their own. Six types. Every figure OBSERVED or DERIVED with its rule named; inference is refused at the boundary. Currency converts only at your own recorded rate, and a report refuses rather than invents one. Each run is sealed with a hash anyone can recompute from the rows, offline, and every run and every read is an entry on your organization's chain.
| Report | Who may run it |
|---|---|
| Ledger | owner, admin, controller |
| Decisions | owner, admin, auditor |
| Discrepancies | owner, admin, auditor |
| AI activity | owner, admin, auditor |
| Tax view | owner, admin, controller |
| Sealed pack | owner, admin |
Nerio, the read sideMinerva, the write sideRequest an assessment
Fides: what may cross a boundary →
What this enterprise runs
Every module is optional, and that is enforced rather than promised.
Nerio, Minerva, Honos, Fides, Forculus, Portunus, Reports and the analytics modules (scorecards, frameworks, costing and planning) are turned on and off per organization. A call into a module you do not run is refused by name before it reaches the module, so nothing has to remember to check. Dependencies hold in both directions: Minerva cannot be enabled while Honos is off, and Honos cannot be turned off while Minerva is on.
Every change names the person who made it and the reason, and is hash-chained with the rest of your record. An organization with no record runs everything, and turns off what it does not want.
| Clause | What it means |
|---|---|
| module.person | Only a named owner or admin turns a module on or off. An agent principal never may. |
| module.unknown | A module that does not exist is refused by name, with the list of those that do. |
| module.dependency | A module cannot be enabled while something it needs is off. Minerva needs Honos, because it executes only what a person authorized. |
| module.dependent | A module cannot be disabled while something that needs it is on. |
| module.off | A call into a module your organization does not run is refused by name, and the refusal says who can turn it on. |
Forculus: the door between the record and the machine →
Film · two minutes
Who may decide what, on the record.
The six rules and the default policy, a named person deciding with the evidence in front of them, the chain every decision sits on, and why nothing in EOS acts without Honos.
The EOS family