Governance Constitution

Status: SUPERSEDED / ABSORBED — historical subsystem constitution. Current authority: INTEGRATEWISE_ARCHITECTURE.md v2.2.
Scope: Two-gate governance model, approval tokens, risk scoring, audit, and compliance rules.
Canonical Owner: IntegrateWise Platform
Last Verified: 2026-07-20

---

1. Purpose

This document defines how IntegrateWise governs execution.

No capability mutates canonical state without governance. No external side effect occurs without approval.

---

2. Two-Gate Model

Gate 1: Pre-Proposal
  - ALLOW_PROCEED
  - DENY
  - REQUIRE_PRE_APPROVAL
        │
        ▼
Twin Proposal
        │
        ▼
Gate 2: Post-Proposal
  - AWAITING_HUMAN_APPROVAL
  - HUMAN_APPROVED
  - DENY

---

3. Confidence Thresholds

Confidence	Gate 2 Action	Token
≥ 0.95	Prioritize for human review; never auto-promote	Human-issued
≥ 0.85	Surface as high-confidence proposal	Human-issued
0.70–0.85	Surface with uncertainty and evidence gaps	Human-issued
< 0.70	Reject or retain as non-actionable candidate	None

---

4. Approval Chains

Action	Level 1	Level 2	Level 3
deal.close (<$10K)	Sales Rep	—	—
deal.close ($10K-$25K)	Sales Rep	Head of Sales	—
deal.close (>$25K)	Sales Rep	Head of Sales	Founder
hiring.open	Department Head	Founder	—
budget.adjust	Finance Manager	Founder	—
release.deploy	Engineering Lead	CTO	—
code.rollback	Engineering Lead	CTO	—

---

5. Audit Rules

1. Every action is logged with actor, capability, evidence, and approval status.
2. Audit retention is immutable and seven-year minimum.
3. Every approval emits a governance token with expiry and scope.
4. Cross-department actions require cross-department approval.
5. Emergency override is Founder-only with full audit trail.

5a. Cryptographic Approval Semantics (Amendment 14)

Every approval record includes:

• payload_hash: SHA-256 of the canonical payload (deterministic serialization)
• previous_event_hash: hash-chain predecessor for tamper detection
• signature_algorithm: algorithm identifier
• signature_key_id: signing key identifier
• signature: signature value
• signed_at: signature timestamp

Human approval identity comes from the validated session and is bound into
the signed canonical payload. SHA-256 verifies content integrity; the
signature provides non-repudiation. Key rotation and verification procedures
must be documented before production deployment.

---

6. Invariants

1. Governance is enforced by architecture, not policy alone.
2. No execution path bypasses Gate 1.
3. No side effect occurs without explicit human Gate 2 approval bound to the
   exact proposal and scope.
4. Approval authority matches risk.