How Govula executes governance work — the feature flags, approval chains, safety switches, and reversible controls that the platform relies on to behave predictably under stress.
Per-tenant boolean (and small-enum) toggles read at the start of each protected route. Flags never replace authorisation; they shape the surface area a tenant can see and act on.
Operator view
A flag turns a capability on or off for a single tenant. The default is always the safe value (usually OFF). Toggling a flag is itself an audited operator action.
The boundary between Govula and a target system. Each adapter declares the targets it accepts, validates them, runs a simulation pass, and returns a rollback handle alongside the action result.
Operator view
An adapter is the thing that actually touches a target system. If an adapter is unavailable, the action stays in the queue rather than running on a half-broken path.
The recorded sequence of named human approvers required for a binding state change. The chain shape is policy-defined; the gate refuses to mutate state without the configured approvers on the row.
Operator view
Approval chains answer "who said yes" before any binding action runs. AI cannot satisfy a step in the chain; only a human can.
A single switch that halts all new state-changing routes across the estate. Read paths and the audit ledger remain reachable; in-flight work completes on its existing path.
Operator view
SAFE_MODE is the stop button. You can engage it without coordinating with any other operator and disengage it the same way once the incident is closed.
Every enforcement action carries a rollback handle. Reversal invokes the stored handle and writes a new ledger row that links to the original action.
Operator view
Reversal is one click and is itself audited. The audit ledger therefore shows both the action and its reversal as separate, linked rows.
Next in Understand: SoA Engine.
continues in "understand"; high glossary density (6 terms)
Ranked using IA v1 graph + intent map + glossary density (deterministic; no AI inference).