Governance of the Navin Platform

This page gives the overview of the governance of the Navin Platform: who decides, which controls apply, where the evidence lives, and which page details each topic. It is meant for the security officer, the AI governance officer, the auditor and the SOC lead.

Version française : ../governance.md

Principles

1. Deny by default and fail closed. An unreachable OPA, OpenFGA, Context Authority, HSM or file scanning engine means deny, never allow.
2. Separation of duties. The requester never approves; high impact actions need two distinct people.
3. Least privilege passed on. An API key, an assumed service identity, a delegation or a sub-agent never has more rights than its creator.
4. No implicit access to business content. Technical administrators go through the resource ACL; platform_admin does not decrypt audit payloads.
5. Everything audited in the transaction. A change without its audit event does not exist: a failed audit write rolls the change back.

Who decides

Decision	Roles	Page
Create a tenant, administer the platform and the IT vault	platform_admin	secrets-vault.md
Publish a policy, write relations	tenant_admin, security_officer	identity-policy-plane.md
Approve a sensitive agent action	approver_roles of the request, else tenant_admin, security_officer, developer, business_owner	approvals.md
Approve break glass	two people among security_officer, tenant_admin	identity-context-delegation.md
Contain an incident, recover after a kill switch	SOC analyst and leads	soc-runbook.md
Classify an AI system, approve a risk assessment	tenant_admin, security_officer, ai_governance_officer	risk-compliance.md
Set retention, erase a person, set a legal hold	tenant_admin, security_officer, data_steward	retention-privacy.md
Release an audit legal hold	two people among auditor, security_officer, tenant_admin	audit-evidence.md
Tighten the file security policy	security_officer, tenant_admin	file-security-pipeline.md

The full list of roles and their rights is in authentication-authorization.md.

Controls per layer

Layer	Controls	Page
Installation	Startup guard, TLS, headers, rate limits, network egress	hardening.md, configuration.md
Identity	Keycloak OIDC, local accounts, API keys, SPIFFE, group mappings	authentication-authorization.md
Authorization	Roles, scopes, clearance, OpenFGA, OPA, delegations, mandates	authentication-authorization.md, identity-context-delegation.md
Human oversight	Approvals, four eyes, change path	approvals.md
Data	Classification, DLP, retention, erasure, consents, encryption	retention-privacy.md, data-protection.md
Secrets and keys	OpenBao, Transit, HSM, IT vault	secrets-vault.md
Untrusted input	File scanning, injection detection	file-security-pipeline.md, injection-matrix.md
Detection and response	SOC, AI-SDR, kill switches, incident runbooks	soc-runbook.md, runbooks.md
Evidence	Audit chain, seals, WORM, chain of custody	audit-evidence.md
Risk and compliance	AI Act assessments, registry, control catalogue	risk-compliance.md

Registry and policies

• Governance registry: GET /v1/governance/registry (agents, models, providers, tools, skills, plugins, connectors).
• Policies: GET /v1/policies, simulation before publishing (POST /v1/policies/simulate), immutable revisions (GET /v1/policies/{policy_id}/revisions), recorded decisions (GET /v1/policies/decisions).
• Tenant security settings and posture: GET /v1/security/settings, GET /v1/security/posture.

Audit and SOC

• Search: GET /v1/audit/events; chain verification: GET /v1/audit/verify (roles auditor, security_officer, tenant_admin).
• SIEM forwarding without sampling and WORM export: ../../operations/en/siem-audit.md.
• Denials and failures are always forwarded to the SIEM; the SOC scanner turns security events into detections.

Periodic review

Frequency	Check	How
Every day	Pending SOC orders, interrupted transactions	GET /v1/soc/orders?status=pending_approval, GET /v1/soc/transactions?status=interrupted
Every week	Pending approvals, active break glass grants	GET /v1/approvals, GET /v1/break-glass
Every month	Posture, old API keys, service identities, risk exceptions	GET /v1/security/posture, GET /v1/api-keys, GET /v1/service-identities, GET /v1/risk/exceptions
Every quarter	Evidence integrity, test restore, role review	GET /v1/evidence/verify, hardening.md, GET /v1/members