Governance & Policies
The non-negotiables — the nine frozen rules that govern the IntegrateWise Self-Organizing Workspace.
These rules are frozen and non-negotiable. They define the boundary conditions for how the system operates, how departments interact, and how governance is enforced across all surfaces.
⚠️
Subdomains never carry tenant identity. Hostname = requested projection; OneAuth session = tenant authority. No
sales.acme.integratewise.ai.The Nine Non-Negotiables
| # | Rule | Description | Impact |
|---|---|---|---|
| 1 | Subdomains never carry tenant identity | Hostname = requested projection; OneAuth session = tenant authority. No sales.acme.integratewise.ai. | Prevents tenant-specific subdomains; authority derives from OneAuth session, not hostname |
| 2 | Two subdomain classes only | Internal-only (platform, founder, ops, book-of-records, brandstore) and shared internal+external departmental. No external-tenant-specific subdomains. | Limits subdomain explosion; only two authorized classes exist |
| 3 | Spine is logical | Neon = canonical substrate, D1 = operational substrate; KV/R2/Vectorize/DO are supporting substrates. None individually is the Spine. | Clarifies Spine substrate split; avoids D1-as-SSOT confusion |
| 4 | No surface owns a database | Every read goes through the Projection Platform API; every write is governed. | No local databases; all access is mediated |
| 5 | No AI write lands without HITL approval | Provenance is immutable; Twin-origin data never masquerades as native truth. | Human-in-the-loop for all AI writes; immutable provenance |
| 6 | OneAuth never copies provider credentials | The host owns the connection; IntegrateWise receives governed projections. | Host-owned auth; no credential duplication |
| 7 | The Twin is contextual, not a sidebar agent | Invoked on a selected object, runs on a context path, closes on navigate-away. | Prevents always-on rail or passive agent; Twin is event-driven |
| 8 | Every write passes through the governed Pipeline — not "straight to D1." | All writes go Loader → Normalizer → Pipeline → operational update → canonical reconciliation → cache invalidation → re-embed. | Single chokepoint for all governance |
| 9 | Departmental tables are allowed, silos are not | Core identity + relationships stay stable; departments may use domain tables; role/industry/presentation variation lives in the projection. | Departments can use domain tables but cannot create silos |
The One Sentence to Freeze
OneAuth enters the host ecosystem. Product Package converts authorized ecosystem access into usable capabilities. Spine connects business truth across canonical, operational, evidence, retrieval, and continuity substrates. The User Workbench turns that connected truth into collaborative work. Platform Backend runs the capabilities at scale. The Self-Organizing Workspace emerges as humans and AI continuously organize work, context, and capabilities around evolving goals.
Subdomain Policy
Two Authorized Classes
| Class | Examples | Access |
|---|---|---|
| Internal-only | platform, founder, ops, book-of-records, brandstore | Internal use only, no external exposure |
| Shared internal+external | Departmental subdomains (sales, finance, support, etc.) | Both internal team and external users |
Prohibited
- ❌ External-tenant-specific subdomains (e.g.,
sales.acme.integratewise.ai) - ❌ More than two subdomain classes
- ❌ Subdomains that embed tenant identity in the hostname
Write Governance
The Governed Write Path
1. Provider / user / Twin event
2. ↓
3. Loader → Normalizer → Pipeline
4. ↓
5. Operational update (D1) → canonical promotion / reconciliation (Neon)
6. ↓
7. Operational refresh / cache invalidation → re-embed
8. ↓
9. Provenance tagged: origin, confidence, approved_by (immutable)Governance Evaluation
| Step | What's Evaluated | Decision Point |
|---|---|---|
| Permissions | Can this user/service perform this action? | Yes/No — if No, block and explain |
| Risk class | R0 (none) through R4 (high risk) | R0-1: auto-approve; R2-4: require human decision |
| Approval need | Does this require explicit user approval? | Yes → pause for HITL; No → proceed |
| Expected effects | What are the downstream effects? | Document and surface to user |
🚫
Twin never executes a destructive or external action from an unreviewed chat response.
Departmental & Silo Policy
Allowed
- Departments may use domain tables (e.g., sales-specific fields, finance-specific metrics)
- Role/industry/presentation variation lives in the projection layer
- Core identity + relationships stay stable across all departments
Prohibited
- 🚫 Silos: Departments cannot own separate databases or independent truth sources
- 🚫 Duplicate identity: Core identity (users, tenants, relationships) must remain stable and shared
- 🚫 Tenant-specific subdomains: No
xxx.acme.integratewise.aipatterns
Quick Reference
Built 2026-08-20 · Nextra 4 · Theme nextra-theme-docs