C0
Open
Non-sensitive material that carries no restriction on where it can appear. The bottom of the ladder.
Governance here is not something the software makes up. It is a ratified, versioned model that the firm already agreed to, owned by the Cockpit governance process. The platform's job is narrow and precise: enforce that model in the data layer, on every access, every time.
The distinction matters more than any single control. Policy is decided by people, through the Cockpit governance process, and captured as a versioned model. The platform does not hold opinions about who may see what; it reads the model the firm already ratified and applies it in the data layer. Every access, every figure, every refusal follows the rules the firm already agreed to, which is exactly what makes the system auditable rather than a matter of trust.
The platform supplies the scope. It never invents policy. When the answer to "who may see this" needs to change, that is a governance decision, not a code change.
Operating principle
The firm classifies data into four levels, C0 through C3. Because most of the figures the platform holds are market-sensitive-adjacent, platform data defaults to C1 rather than to open. The most sensitive classes are handled with a hard, simple rule that leaves no room for judgment in the moment.
Non-sensitive material that carries no restriction on where it can appear. The bottom of the ladder.
Market-sensitive-adjacent figures. Platform data lands here by default, because most numbers in the book qualify.
Sensitive terms and figures held under tighter clearance. Never posts to any Slack channel, ever.
The narrowest tier, handled in a physically separate store. Never posts to any Slack channel, ever.
The two most sensitive classes are never rendered into any channel under any condition. There is no exception path to weigh in the moment.
Defaulting to C1 means a figure is protected until someone deliberately classifies it lower, not exposed until someone thinks to protect it.
There is a single access model, and it lives where the data lives. Six role tiers, R1 through R6, are enforced by row-level security in the database from day one, through the shared foundation kernel. There is no second permission system layered on top that could drift out of agreement with the first.
Reporting is auditable, not a matter of trust, because the evidence travels with the number. Each figure carries the data class it holds, the source document it came from, and the date it was true. Every change to a figure is recorded in a figure-changes record, which sits on top of the foundation's action audit spine.
A figure is never a bare value. Its data class, the document it was extracted from, and its as-of date are attached to it and move with it wherever it is quoted.
Every change to a figure is written to a figure-changes record, so the history of any number can be reconstructed rather than reasoned about after the fact.
The figure-changes record sits on top of the foundation's action audit spine, giving reporting an evidentiary trail rather than a request to take it on faith.
Separation is physical, not just logical. Open and confidential data live in a shared store; the most sensitive classes live in a walled store. These are separate Supabase projects with separate credential scopes, so reaching the walled data requires credentials the platform simply does not carry.
Open and confidential data live here, in its own Supabase project with its own credential scope. The platform builds entirely on this store.
The most sensitive classes live in a separate Supabase project with a separate credential scope, physically apart from the shared store and from the platform.
The platform is the only system that extracts and writes financial-document data, and the boundary around that privilege is deliberate. Untrusted content is never allowed to steer what the platform ingests, and the platform's outputs are never mistaken for its inputs.
The platform is the sole system that extracts and writes financial-document data. That privilege is not shared out to systems that could be steered by whatever content lands in front of them.
When another system forwards a document to the platform, that forward runs as a deterministic post-classification rule or a gated action; it is never a model's free choice to pull something in.
Machines never read bot posts. Downstream registers are fed by database events; a Slack post is a rendering of state, never the state itself.
Two controls make the failure modes safe by construction. When someone asks for a figure above their clearance, the platform does not stretch; and when the platform reaches for a model, it cannot silently fall back to a weaker guarantee.
An ask above the requester's clearance returns a dashboard deep link, not the number. Nothing over-shares; the boundary is a redirect to what the role may open, never a leak of what it may not.
All model calls go through the firm's own gateway, and code references capability tiers rather than model names. The most sensitive data classes route to local-only providers pending explicit approval, with no fallback that would weaken that guarantee.
Honesty about what is not yet true is part of being trustworthy. The Slack channel surface depends on a governance amendment, version 2.2, that must be signed by the General Counsel before it ships. That amendment is drafted, not yet ratified, and the platform does not front-run the signature.
Governance amendment v2.2, which the Slack channel surface depends on, exists in draft form inside the Cockpit governance process.
Ratification is a human decision made in that process. Until the amendment is signed, it is not policy, and the platform treats it as if it does not yet exist.
The Slack channel surface ships only after the signature lands. The platform does not run ahead of the ratified model to deliver a convenience.
The controls above are not promises to keep later; they are properties of the data layer from day one. Adoption is staged so each step earns the next, and every access along the way follows the model the firm already ratified.