From intent to audit trail – by construction.
Kovac turns user or AI intent into governed execution: policy check, signed plan, scoped execution and an immutable audit trail.
The five-step flow
- 1
Intent captured
A person, workflow or AI agent requests an action.
- 2
Policy evaluated
Checked against identity, ontology, permissions and clearances.
- 3
Plan signed
Approved work is compiled into a signed execution plan – id, intent and code hash, signed with the kernel key.
- 4
Execution scoped
Engines and connectors run only within the plan's bounds.
- 5
Audit recorded
Decision traces, lineage and approvals captured as queryable artifacts.
Representative flow – illustrative, not a product screenshot.
Ontology and Object Types
You model your organisation at the level of meaning. A dataset can be promoted to an Object Type – a typed semantic object that carries the same governance as the data beneath it. Object Types are what the rest of the platform, and any AI agent, reads.
Policy and clearances
Policy is evaluated in the kernel as pure logic over identity, ontology and request. Clearances attach to data at the column level and are enforced by both policy-as-code and a permission graph – so access is determined by design, not by a policy someone has to remember to apply.
Signed execution
Every approved request compiles to a bounded plan, signed with the kernel key over its id, intent and code hash. Engines are handed that plan; verifying the signature at execution, and closing the remaining ungated read paths, are T8-13 and T8-03.
Decision traces and time travel
Grants and denials are rendered as queryable graphs that explain the reasoning, and because ontology, policy and lineage are versioned you can reconstruct the governed state of your data at a past point. Signing the trail at write is T8-07.
The architecture boundary
The Kovac kernel is the deterministic control core. AI and orchestration run as a governed client – no special trust – and retrieval and RAG happen outside the kernel boundary. Your warehouse and compute stay pluggable. The kernel governs what runs, not how.
What Kovac is not
It sits between AI and your data to make data use governed and auditor-grade.
See the mechanism on your data
A technical walkthrough, or a focused Proof Pilot against one of your real datasets.