Settle a claimAllowed
£42,300.00
Inside the £500,000 ceiling the pack sets. Nine checks, none failed.
Allow. Hold. Refuse.
The kernel is the deciding layer of the platform. It is asked one question, in one shape: here is a proposed action — may it execute? One of three answers comes out, and each answer means exactly one thing.
- proposed
- an action inside its stated bounds
- verdict
- ALLOW
- record
- sealed and signed
- proposed
- the same action, over its ceiling
- verdict
- REFUSE
- record
- the refusal, and the checks it failed
Illustrative. The shape of a decision, not a live record.
Verdicts
What each verdict means. Three answers, and no fourth.
One question goes in, in one shape. One of three words comes out, and each of them is a decision reached the same way and recorded the same way.
Issue a refundHeld
£18,750.00
Above the £5,000 limit this agent holds. A person releases it, or not.
Settle a claimRefused
£612,000.00
Over the pack’s £500,000 ceiling. Value limit did not pass, and the record names it.
Illustrative. Three decisions in the shape the kernel records them, under the insurance pack’s limits. Not live records.
Allow
The proposal sits inside every bound that applies to it. Allow is the only verdict that lets an action through, and it is a decision like the others — reached the same way, recorded the same way.
Hold
The kernel will not decide this one alone. The action holds until a person with the authority releases it. An action held for approval resumes by replaying only what was approved — nothing else.
Not a near miss, not a variation. The approved action.
Refuse
The proposal breaks a rule, or cannot be shown to keep one. A refused action is recorded with the reason it was refused — the failing checks, by name.
A refusal without a reason is a shrug; this one is a document.
Failure mode
It fails closed. In three directions, stated in advance.
Most software fails open: when something is missing or wrong, it carries on and logs a warning. A governance layer cannot borrow that habit.
Before, not after
Every action the platform governs is checked before it executes; an action that fails its checks does not execute.
There is no version of this where the action runs first and the check catches up.
Cannot decide means refuse
When the kernel cannot decide, the action is refused, not waved through.
Missing input, an undischarged check, an empty verdict set: all land the same way. Doubt is a refusal.
It checks itself first
If the kernel’s own checks cannot be discharged at start-up, it does not serve at all.
A governance layer that cannot vouch for itself has no business vouching for anything else.
Properties
Two properties a reviewer can stand on.
The same verdict, every time
Same input, same verdict, every time. Ask the kernel today and ask it again in a year: the answer does not drift. Determinism is the property; drift is what it rules out.
That is what makes a decision reviewable after the fact. A verdict you can re-run is a verdict you can examine; one you cannot re-run is a story about what the system probably did.
Refusal reaches the database
A rule that lives only in application code holds only where that code runs; a second code path is a way around it. Where the platform gates a dispatch, the refusal is enforced at the database itself, on every write path.
The refusal sits at the one layer every write must pass. Going around the application does not go around the rule.
What we do not publish
No diagram of the inside. What it does, you can watch. What it leaves, you can check.
There is no diagram of the kernel’s internals on this site, and there will not be one. A diagram asks you to trust a description of the machine. A verdict you have watched and a record you have verified ask for no trust at all.
Demonstrable
Bring a proposed action to the Gate and watch the verdict land. What the kernel does is shown, not described.
Checkable
A record can be verified offline, without access to our systems. What the kernel produces is yours to check.
Protected
Between the behaviour and the evidence sits the mechanism. That is the part we keep.
Any sentence on this page that could only be defended by the diagram has been cut.
Watch it decide
A proposal goes in. A verdict comes out.
The Gate runs synthetic scenarios. You read the record each one leaves. No personal data.