Governance — human authority, including what it delegates, on the record.
Saphan Studio governs what AI agent fleets change. Work advances only through recorded decisions with evidence attached — and the guarantees below are properties of the system's construction, described here at the level of what they do.
What the record guarantees
The engine cannot authorize itself
The engine transports work and records decisions; it has no ambient authority of its own. Advancement requires either an explicit human decision or a bounded delegation from a signed human policy. A defaulted decision is unrepresentable, and “merged” is never a status the engine grants — it is only observed from a real merge.
Silence is never consent
No timeout anywhere grants approval. Delegated acceptance exists — but only under a named policy owned by a signed human, scoped to explicit classes of change, never to a clock. Autonomy is a policy you sign, not a default you drift into.
Segregation of duties is structural
Implementer, reviewer, and approver are distinct roles on the record with tooling-enforced footprints — a reviewer cannot advance the stream it reviews. A decision attempted out of order is refused with a list of what is still owed, and nothing is written on refusal.
Suggestion and decision are separate events
Consultation — by a model or a person — is recorded as judgment. A decision is a separate act by an authorized actor; if that actor is automated, its authority must trace to a bounded, human-signed delegation. The two can never blur into one entry.
Refusals are data
Every refusal lands as a durable record with its named class and reason, at near-zero cost. Accountability covers not only what the system did, but what it declined to do — the refusal ledger reads as the money and the risk that did not leave.
No lateral agent channels
The product ships no agent-to-agent messaging of any kind. Every coordination surface is a recorded one — orders out, evidence-bearing returns in, gates between. “Who told whom what, when” is a query, not an interview.
Three kinds of proof
Acts of governance — non-repudiation
Who was admitted to the fleet, by whom, when, with what authority — signed acts a third party can verify against the owner’s public key alone, without trusting the machine that produced them.
Gate decisions — tamper evidence
Every gate decision carries the actor, the decision, the timestamp, and the evidence it rested on. A later edit of any field breaks verification — and verification is re-checked at merge, not just at write time.
Run records — provenance
What ran, under which configuration and which standing law, at what cost, in what time — and on a refusal, the rule and the reason. The record names what actually happened, not what was requested.
The registries people read are projections of this record, never sources: nothing is edited in place, a status change is a new append, and a read resolves to the latest entry.
Why this stands audit
Evidence in, or no gate. An approval without proof is unrepresentable — by construction, not by convention — so the audit trail is a by-product of how the work happens, not something collected around it afterwards.
The record is designed to map onto the change-management controls organizations already answer for — who changed what, on whose approval, with what evidence. What that means for your certifications and regulators is its own brief:
More of Saphan Studio
Controls — what is in place, control by control →Security — untrusted agents, provable runs →Cost — quoted, capped, attributed →Built on Saphan Protocol →
Design partner inquiries
Contact us — [email protected]