Technical model / application and platform boundaries
NEES Governance Platform architecture
The application proposes a registered action and owns its real-world effects. NEES evaluates supported governance facts; an ALLOW decision does not itself execute tools, bypass application security, or prove external success.
Platform components
- Core V3: generic private governance engine evaluating supported published facts and commitments.
- Hosted Runtime: backend-facing lifecycle and operation/evidence/receipt inspection.
- Control Plane: authorized publication and management of governance state, separate from execution.
- Developer Dashboard: account and runtime onboarding, registered-action setup and read-only assessment resolution.
- Direct integrations: compatible Python SDK and version-matched REST from trusted backends.
- Mediated integrations: supported Gateway/Proxy, MCP and framework hooks; their route and version coverage must be validated.
- Evidence/receipts: reviewable supported records for correlating authorization and reported outcomes.
The supported action lifecycle
- SUBMIT: send a registered action and true actor, resource, operation, capability, scope and context.
- QUALIFY: evaluate the published authority, policy, tool requirements and version-bound assessment. Missing or stale commitments are not permission.
- START: proceed through the supported authorization boundary only when governance and current application context permit.
- EXECUTE: the owning application checks its live target and performs only the authorized external effect.
- REPORT: return the observed result, including failure or uncertainty. Inspect operation, evidence and receipt; do not infer success from ALLOW.
Trust boundaries, limitations and failure behavior
Application-owned enforcement matters: an integration path that bypasses the supported decision boundary is not automatically governed. A gateway only mediates configured routes; it does not intercept every process or tool.
Missing, denied or unavailable governance must not trigger an external side effect. A network timeout does not prove permission or execution. Retrying side-effecting actions requires contract-supported idempotency and reconciliation.
The Dashboard can resolve an existing assessment without changing state, but publishing governance is a separate administrative operation.