Govern the business from inside it, with evidence as a by-product

Five design rules

1. Contracts create obligations; obligations create work. A signed contract is designed to feed renewal dates to Finance, SLAs to Service Desk, deliverables to Projects and controls to GRC as governed Actions, not just reminders.
2. Consent gates every use of personal data. One consent ledger is checked before every send, render, profile, agent memory write and export in every app. This app never writes consent records itself; it calls the platform consent Actions, so there is exactly one consent ledger in the tenant.
3. Evidence is a by-product of work. Controls, audits and findings read the platform event log and the Trust & Audit evidence store instead of screenshots.
4. Findings become fixes. A failed control or overdue obligation creates a remediation Action in the owning app, such as revoking access, updating a vendor or pausing a campaign, with approval and audit.
5. AI does the preparation, people decide. Legal conclusions are advisory and cited. Lawyers, DPOs, auditors and risk owners approve.

Thirteen modules

• W3: Contracts (CLM) and Consent Management (core), Privacy Ops and Policy-as-Code.
• W4: GRC, Enterprise Risk, Internal Audit (delivery proposed for W5), KYC/KYB, Fraud & Risk Scoring, Whistleblower & Ethics, Records Management, and AI Assurance & Model Risk.
• W5: eDiscovery & Legal Hold.

The modules share one evidence store. Contracts pass DPA terms to Privacy Ops and obligations to GRC; compliance risks roll up to Enterprise Risk; the risk register shapes the audit universe; audit findings land on GRC controls; KYC signals feed fraud scoring; ethics themes feed risk; and legal holds block records disposition.

Deterministic where the law is computed

Consent checks, notice and renewal date arithmetic, request and breach clocks, retention computation, hold checks, disposition eligibility, KYC rule outcomes, fraud rule scores and policy evaluation are deterministic engines. AI may draft inputs, explain results or extract data that a person confirms. It never decides whether consent exists, whether a hold applies or whether a record can be destroyed. There are no automated adverse decisions on people: KYC rejection of individuals, fraud blocks on individuals and ethics outcomes are human decisions.

Where it fits

The app runs on the platform's Trust & Audit, Admin & Policy, Approvals and Fact Register, and works with CRM, People, Finance, Office (Mail, Chats, Drive, Sign) and the AI Workforce. Restricted data such as ethics cases, KYC documents and held collections is routed only to in-region models.

Regulatory pointers

DPDP, POSH, vigil mechanism, KYC periodicity, e-stamping, retention statutes and framework licensing are recorded in the Fact Register and must be verified with counsel. Nothing on this page is legal advice.