---
title: "Policy, approvals and audit"
---

# Policy, approvals and audit

How your organisation's signed policy, approvals with electronic signatures, the device audit ledger and evidence packs work across the Editor, the Agents app and the CLI.

Governance in Neural Inverse Build is one policy, one decision point and one approval system, applied the same way in the Editor, the Agents app, the agent host that runs every agent engine, the CLI, git hooks and CI. It works locally: no Neural Inverse server is called. Where your organisation runs Neural Inverse Govern, Govern can also deliver a signed agent policy.

## What binds where

A modified build can remove any check inside an app, so the design puts each control where a modified client cannot skip it, and makes local bypasses visible.

| Control | Enforced by | Notes |
|---|---|---|
| Agent tool calls, commands, file writes, network, MCP servers, models | The agent host, through each engine's hooks and settings | An engine run outside the agent host is not covered |
| Accepting agent changes; in-app actions (extensions, tasks, workspace trust, MCP, settings, models) | Both apps, through one governance service | CI re-checks what reaches the repository |
| Commit and push gates | git hooks | Local hooks can be skipped; CI runs the same checks on the exact commit |
| Merge and release gates | Your CI | Binding when required checks run from protected configuration |
| Organisation models, data loss prevention, budgets | Govern | Applies whatever client is used |

## Policy

Your organisation's policy is a signed bundle. It sets roles and approval rules, engine rules (tools, commands, paths, network, MCP servers, models, allowed engines), in-app rules, rules for domain-module hardware actions such as flashing or writing a bitstream, and whether agent audit events may be uploaded.

- **Signed and pinned.** Bundles are signed with Ed25519. Only keys pinned in the build, plus keys added by managed policy, can sign one. A bundle that fails any check is rejected whole, with the reason recorded.
- **Where it comes from**, strongest first: managed policy; your organisation's Govern deployment (verified on the device); the policy you imported; the repository's `.neuralinverse/policy.bundle.json`; the last accepted bundle. A Govern policy adds its deny and approval rules to the bundle in force; restrictions only add.
- **No rollback.** The highest accepted version is kept in the operating system's keychain. An older bundle, or a different bundle with the same version, is refused, and deleting the cached policy locks rather than loosens.
- **Offline.** A cached policy stays in force until its expiry and grace. After that, agent sessions, tool calls, model calls and governed commands lock on every surface. Editing and saving files keep working.
- **No policy.** The built-in baseline applies as advice, and the views say "no organisation policy". Agent self-protection still binds: an agent cannot change policy and approval records, git hooks, CI configuration, shell profiles, or audit and governance data without a person.

Unsigned rules in a workspace (`.neuralinverse/policy.local.json`) only warn; they never block and never satisfy anything.

## Approvals and electronic signatures

When the policy says an action needs approval:

- If no approval rule or control applies, the person present can approve it.
- If an approval rule applies (for example separation of duties), the action is blocked until other enrolled approvers sign. The app offers to request the approval.

An approval is a signature record in the repository under `.neuralinverse/records/`, so it travels through git, is reviewed in pull requests and is verified by CI. Each signature carries the signer's printed name, the time, the meaning (review, approval, responsibility, authorship), the reason, and what was signed. Signing needs re-authentication: Touch ID on macOS, the Windows account password on Windows, or a signing passphrase elsewhere. Verification refuses a changed request or content, a key not enrolled for that person, a replayed record, an expired request, and any separation-of-duties breach (the author, the person who prompted the agent that wrote it, or the requester signing).

Records support your own controls for electronic records and signatures. Identity verification at enrolment, account management across the organisation, and certification remain your organisation's processes.

## The audit ledger

The Editor, the Agents app and the agent host record what people, agents, extensions and command-line tools do in a ledger on the device: encrypted and tamper-evident. Capture is for security and compliance, not performance management.

- **Stays on the device by default.** Your organisation can turn on uploading of agent events to its own Govern deployment, and separately release a person's own actions. Uploading needs a signed-in session. No telemetry is sent to Neural Inverse.
- **Set only by managed policy.** Audit settings are governed: a value in a settings file has no effect. Loosening a setting needs a confirmation in the app and is recorded; tightening applies at once.
- **Every governance step is recorded**: decisions, policy changes and rejections, approval requests and signatures, gate results and locks.

The CLI writes its own JSON Lines audit log when `audit.enabled` is set. See [the CLI](https://neuralinverse.com/docs/cli/enterprise/#audit-log).

## Evidence packs

From the ledger, the Editor builds a signed evidence pack (`.nievidence.tar`) for a release, a change, a trace or a time range. A pack answers six questions with a verdict for each and every gap listed:

1. Which lines did AI touch?
2. Which model and context were used?
3. Who approved?
4. What left the boundary?
5. What happens when a log is deleted?
6. Can the result be reproduced?

Packs include standard formats (OSCAL, in-toto, SLSA, CycloneDX), an HTML report and CSV tables, and anyone can verify one offline. Packs from several developers combine by importing each developer's signed bundles. A pack is evidence toward a requirement, not a certification, and it is tamper-evident: changes are detected, not prevented.

## Checks

Checks runs deterministic analyzers on every change an agent proposes and on every commit. Only rules in your organisation's signed policy can block; nothing a model produces is a finding or can block. Findings are evidence for your own process; Checks does not claim compliance with any framework.