The write side. Kept separate on purpose.

What Minerva does

It executes what Nerio has evidenced and a person has authorized. A request that was not authorized cannot be executed by anyone, because Minerva reads the authorization from the record rather than taking the caller's word for it.

Or it carries the decision to your own systems by dispatch. Your executor (your integration platform, your procurement agent, your middleware) receives a signed, single-use authorization naming the request, the decision and the state it intends; it makes the change with your own credentials before the authorization expires, and reports back, signed. Minerva never holds a write credential to your systems of record. A change a person made in their own system is recorded here with its reference, and reversed the way it was made, by a new request.

Then the loop closes. EOS does not take the executor's word, or anyone's: it verifies that every system reporting the fact was observed afterward in the decided state, keeps what each showed before, and holds the change in flight until then, so no agent acts on it twice. A change that never lands is reported unverified; one that lands differently, diverged.

An agent carries out an approved request only where an owner granted it execute authority with a per-action and a daily limit, only by dispatch, and never past dual control.

It also carries documents between organizations. A purchase order issued by one tenant travels to another, is visible to both and to nobody else, and can be accepted or disputed on the record.

The five rules the code enforces

Each rule is a test on the service that fails if the rule is removed. Thirty-four tests pass at the build this page describes.

What writes where

Until then, the export is the bridge, and the ledger is the record.

Tenancy

Minerva acts for an organization, not a person. Membership is a record with a role on it, and every read and every write is scoped to the caller's organization. Roles: owner, admin, buyer, controller, member. A buyer can execute; a controller can countersign and reverse; nobody can countersign their own request or execute what they countersigned.

Compliance, stated exactly

Minerva implements controls that a SOC 2 or ISO 27001 audit would examine: separation of duties, dual control, immutable chained records, least-privilege roles, reversibility, and idempotency. It does not hold a SOC 2 report, an ISO certificate, or any attestation. Those are an auditor's signature, and no software can grant them to itself. The controls document in the operator kit maps each control to the evidence an auditor would ask for.

Personal data in Minerva is an account id, a role, and the documents an organization chooses to issue. Account deletion on the estate erases the account's own records; documents issued on behalf of an organization remain the organization's, as a purchase order remains a company's record after the buyer leaves.

How Nerio and Minerva connect

Nerio evidences and a person authorizes; Minerva reads the record and executes; Nerio verifies. Minerva never writes into Nerio's observations, disagreements or decisions, and Nerio never calls Minerva. The join is the request id: when Minerva carries a request out, the service opens Nerio's verification of the state the decision intended. The proof is the policy version and the clauses on the EOS record that Minerva quotes when it executes, then the observations that show the change landed.

See Minerva on the platform Start an evaluation Read the trust page

Film

Minerva acts.

Two and a half minutes on the write side: the five rules, the chain, the reversal recorded before the write, dual control, what writes where, the ledger on the platform's synthetic tenant, and compliance stated exactly.

The EOS family