Skip to main content

ADR-0192: Navin Enterprise HSE and Compliance Agent, an HSE product layer on top of the Control Plane

  • Status: proposed
  • Date: 2026-11-04
  • References: agent_uses_cases/10_Industrie_HSE_Conformite.md, .navin/continuity/DECISIONS.md (UC-06 to UC-10 identities, template ids of at most 40 characters, single frontend), ADR-0176 (copied generic modules), ADR-0181 (broker agent, reference pattern), OPA package eai.industrie_hse, contracts industrie-hse-copilot-event and industrie-hse-action-request, Manager template navin-industrie-hse-agent (published: false).

Context​

An industrial site wants to analyse incidents, inspections and applicable requirements, spot risks and gaps, then follow corrective actions with owners, evidence and validation by HSE professionals. The brief requires eight modules (risks, incidents, inspections, obligations, root cause analysis, actions, measurements and competences, verification and reporting), three explicit server-side state machines (incident, inspection, obligation) answering 409 on any forbidden transition, and absolute bans: the model never declares conformity, never closes an incident or an action, never files a regulatory report and never grants a permit. An environmental measurement is an indicator, never a conclusion.

Decision​

  1. Product industrie-hse, folder navin-enterprise-industrie-hse/, Python package navin_hse, prefix /api/v1/industrie-hse, development ports 3483 / 8482 / 6403, PostgreSQL schema hse.
  2. FastAPI backend derived by copying the generic modules of the broker agent (action gateway, jobs, worker, RLS session, audit, i18n, observability, connectors), changing only the package name; only business modules are written.
  3. Every write goes through the Action Gateway (Idempotency-Key, If-Match, maker-checker for sensitive operations, confirmation by the EHS/ERP/CMMS source, unknown_pending_confirmation state then re-read). No local closed status of a corrective action is set without the source system's confirmation.
  4. State machines are versioned data; closure and effectiveness transitions need a second human other than the author.
  5. A measurement is compared to a limit only when unit, averaging period and method are equivalent; otherwise the result is not_comparable, never a conclusion.
  6. Policies: OPA eai.industrie_hse (delegation matrix, second-human operations) and additive OpenFGA types; no own UI, the product manifest is the interface of the common frontend.
  7. The Manager template stays prepared and published: false, never written under navin-manager/catalog.

Consequences​

  • Connectors are exercised in a deterministic sandbox; no simulated confirmation is presented as the real source's.
  • Medical data and witness identities are partitioned and absent from general dashboards.
  • A later extraction of the generic modules into a shared library stays mechanical.