Governed by construction, not by policy

1 · Every change is an event

Nothing is edited in place. A command produces an event carrying the actor, the time, the hash before, the hash after, and a chain hash over its predecessor. A correction is a new event; the original stays visible. Insert, delete or alter anything and every chain hash after it changes.

2 · The catalogue is closed

191 event types, and no others. An event type with nothing able to emit it reads as capability while being unreachable — the project control standard once reported a missing daily site diary on every project because no command could write one. That is an invariant now: every event is either emitted, or named with the reason it is not.

3 · Authorisation is layered and fails closed

Role permissions, then OAuth2 scopes, then attribute rules on the record itself — lifecycle phase, data sensitivity, tenancy. A phase gate is evaluated from the ledger rather than asserted, so a command locked in Operations says which phase it needs. The browser holds no rule the API does not publish: the permission matrix and the phase gates are fetched, never duplicated.

4 · Replay proves it

Rebuild every entity from the log, verify each event independently, and emit a state root. Where your access policy withholds a record, the redaction is reported and the root still covers the complete record — so you can verify the chain is intact without being shown what you may not see.

5 · What leaves the platform is redacted by audience

An export is the one artefact that escapes every access control in the system, so redaction is the last enforcement point there is. A regulator's copy carries no forecast margin, and it says the commercial detail was withheld rather than showing an empty section — a silent redaction is indistinguishable from a project with no commercial data.