Read-mostly. Today the console holds SELECT only, per the grants in 001_packages_and_console.sql and the VAL-CHER-PLANE-001 boundary test.
Holds no authority. It decides nothing, records no approval outcome, and writes nothing to governance, evidence or audit.
Context and assumptions
Every assumption the package treats as material or decision-changing is CONFIRMED by a named party.
Derivation records how the fact reached the package - DECLARED, INFERRED, CONFIRMED or DEFAULTED. It is not a truth class, and OBSERVED or ASSURED can never appear here. A confidence of 1 on a DECLARED fact means the declarer was certain, not that CHER observed it.
- DECLARED10
- INFERRED4
Context facts (14)
- jurisdictionDECLARED
ZA
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
The responsible party is South African.
- processingJurisdictionDECLARED
ZA
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
The engine and all evidence are hosted in a South African region. Only console session and operator identity data reach the vendor platform's EU region.
- sectorDECLARED
software_products
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
No basis recorded
- domainDECLARED
engineering_assurance
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
No reference architecture exists for this domain. GAP-CHER-001 records it.
- archetypeINFERRED
control_plane
- Confidence
- 0.88confidence in the derivation, not evidence of the value
- Confirmed by
- -
Long-running governed workflow over external execution systems, with an evidence store as the system of record.
- criticalityINFERRED
HIGH
- Confidence
- 0.92confidence in the derivation, not evidence of the value
- Confirmed by
- -
No basis recorded
- dataClassificationINFERRED
RESTRICTED
- Confidence
- 0.9confidence in the derivation, not evidence of the value
- Confirmed by
- -
An assurance control plane holds the security posture of other systems. Compromise is a supply-chain event, not a single-tenant one.
- personalInformationINFERRED
true
- Confidence
- 0.95confidence in the derivation, not evidence of the value
- Confirmed by
- -
Operator identities are personal information even where no customer data is processed. Experimental V1 processes no customer personal information: all engineering runs use synthetic briefs.
- specialPersonalInformationDECLARED
false
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
No basis recorded
- externalExposureDECLARED
true
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
The console is reachable from the public internet.
- aiUsageDECLARED
true
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
Specialist roles are implemented as bounded model calls. This activates AI governance controls even in Experimental V1.
- actorTypesDECLARED
engineer, privacy_authority, assurance_authority, platform_administrator
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
No basis recorded
- integrationCandidatesDECLARED
software_factory, model_provider, object_storage
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
No basis recorded
- deploymentContextDECLARED
split_plane
- Confidence
- 1confidence in the derivation, not evidence of the value
- Confirmed by
- -
Console on a vendor platform, engine on self-managed infrastructure. ADR-CHER-003.
Assumptions (3)
Ordered by the materiality the package assigns, weightiest first. Materiality and status are recorded separately: an IMMATERIAL assumption at OPEN is not a problem, and a DECISION_CHANGING one at OPEN is.
- ASM-CHER-001materiality DECISION_CHANGINGstatus CONFIRMED
Operators consent to their identity and session data being processed in the vendor platform's EU region for the duration of the experiment.
- Affects
- REGULATION
- Confirmed by
- person:privacy-authority@cher
- Confirmed at
- 2026-08-27T15:50:00Z
Not named in the package's trace graph - no chain to follow
- ASM-CHER-002materiality DECISION_CHANGINGstatus CONFIRMED
The console platform's generated code cannot be trusted to enforce governance or evidence integrity, so those writes are made structurally unreachable from the console's database roles rather than merely prohibited in code.
- Affects
- ARCHITECTURE, SECURITY, ASSURANCE
- Confirmed by
- person:security-authority@cher
- Confirmed at
- 2026-08-27T15:52:00Z
- ASM-CHER-003materiality MATERIALstatus CONFIRMED
Evidence integrity in Experimental V1 is tamper-evident, not tamper-proof, because the object store in use offers no retention lock. This is stated to customers rather than implied away.
- Affects
- ASSURANCE
- Confirmed by
- person:assurance-authority@cher
- Confirmed at
- 2026-08-27T15:54:00Z