Knowledge Fabric & Intent Fabric — Governance & Retrieval Console

Pending Approvals

Human-in-the-Loop review gate. Actions flagged by policy rules require explicit authorization before execution.

Requires Approval ID: appr_sec_7a2f

Tenant: security-ops

Emergency access review for user jdoe@corp.com

Grounded in: access_control_standard.md §4.2

1. Retrieve user active directory privileges analysis_review (allow)

2. Create Jira post-incident reconciliation ticket ticket_create (requires approval)

3. Dispatch alert to Security Operations Channel notification_send (requires approval)

⚠️ Policy Reason: Ticket creation and external user notifications require human review before dispatch.

Retrieval Playground

Query evidence across tenants with full-text BM25, dense vector search, RRF fusion, and Cross-Encoder reranking.

Returned 3 ranked evidence snippets in 8ms (PostgreSQL + pgvector).

access_control_standard.md §4.2

Score: 0.9416

"Emergency access provisioning requires explicit CISO or designated Incident Commander sign-off. When break-glass credentials are checked out: an automated access review ticket must be generated within one hour to initiate post-incident reconciliation."

change_management_policy.md §2.2

Score: 0.8120

"All emergency changes must be logged and linked directly to an active P1/P2 incident record. Emergency change approvals require verbal or digital authorization from at least one authorized Change Approver."

incident_response_guide.md §6.3

Score: 0.7450

"Break-glass accounts are reviewed quarterly and after every active activation. When emergency access has been granted to any user, the incident response team must generate an audit ticket in Jira."

Live Audit Trail

Immutable event log of retrieval queries, policy rule evaluations, and human approval decisions.

Event Type	Actor	Tenant	Details	Timestamp
retrieval_run	analyst@corp.com	security-ops	Query: "What is the process for emergency access provisioning?" (8ms)	Just now
policy_evaluation	policy_engine	security-ops	Plan plan_8b2e evaluated -> REQUIRES_APPROVAL (rules: ticket_*, notification_send)	2 mins ago
document_ingest	sync_cli	security-ops	Ingested 3 docs, 29 chunks with nomic-embed-text	10 mins ago

Policy Engine Sandbox

Inspect active YAML policy rules and test action strings against the governance engine in real time.

Test Action Type (e.g. ticket_create, db_drop, analysis_read)

Decision: DENY

Matched Pattern: db_* (Priority: 100) • Reason: "Destructive database operations are strictly prohibited."

Active Declarative Rules (config/policy_rules.yaml)

Pattern	Decision	Priority	Reason
`db_*`	DENY	100	Destructive database operations are strictly prohibited.
`external_write`	DENY	100	Direct writes outside simulation boundary are forbidden.
`ticket_*`	REQUIRES_APPROVAL	50	Ticket modifications require human sign-off.
`notification_send`	REQUIRES_APPROVAL	50	User notifications require human review.
`analysis_*`	ALLOW	10	Read-only analysis actions are pre-approved.