Can an author approve their own rules?

No. The four-tier RBAC model enforces separation of duties — a Rule Author cannot approve their own submissions. The Reviewer and Author roles are distinct. This is enforced at the API layer, not just the UI.

Is the audit trail tamper-proof?

The audit trail is append-only and stored with timestamps. It is not a cryptographic hash chain — we document this explicitly in the compliance evidence pack. Every governance event (submission, approval, rejection, publish) is recorded with the acting user ID.

Does DecisionManager support SSO?

Yes. SSO/OIDC is supported on Business and Custom plans. The Admin console's SSO configuration accepts any OIDC-compatible provider (Okta, Azure AD, Auth0, etc.).

Governance

Draft to production. No shortcuts. No bypasses.

Every ruleset version follows a governed lifecycle enforced at the API layer — not just the UI. Four-tier RBAC with separation of duties. Immutable audit trail. Compliance evidence pack for security reviewers. SSO/OIDC on Business and Custom plans.

Start free trial Book a demo

Ruleset version lifecycle

Every version starts as draft and moves through the lifecycle by explicit action — never automatically.

draft

Rule author creates or modifies. Not visible to the Decision Server.

in_review

Submitted for approval. Reviewer is notified. Author cannot modify.

approved

Reviewer signed off. Can receive live traffic in champion/challenger. Can be deployed.

published

Live in production. The Decision Server executes this version.

rejected

Reviewer rejected. Returns to draft with reviewer comment.

archived

Retired. No new executions. Still queryable in warehouse for audit replay.

Four-tier RBAC

Rule Author

Create, edit, and submit rulesets for review. Cannot approve own submissions. Cannot access production deployments.

Reviewer

Approve or reject submissions. Cannot author rulesets. Cannot deploy without separate Deploy permission.

Admin

Full workspace management: members, groups, SSO, API keys, webhooks, AI provider configuration.

Audit Observer

Read-only access to decision logs, governance trail, and warehouse. Cannot modify any artifact.

Separation of duties: a Rule Author cannot approve their own submissions. Enforced at the API layer, not just the UI.

Audit trail & compliance

Append-only governance trail

Every state transition (submission, approval, rejection, publish) is recorded with timestamp and acting user ID. No event is ever modified or deleted.

Compliance evidence pack

The Admin console generates a compliance evidence pack for security reviewers: RBAC configuration, SSO status, audit log export, and platform behaviour documentation — all from live endpoints, not a PDF template.

Honest documentation

We document what the platform does not do: no cryptographic hash chain, no legal hold, no data residency SLA. A reviewer who finds these limits on the page can trust the rest of it.

Governance is not an add-on

The full lifecycle, RBAC, and audit trail are included on every plan including the free trial. SSO/OIDC requires Business or Custom.

Start free trial Book a demo