Two separate questions
Neither depends on the other. A Mode B integration can produce L2 evidence: a signed record of writes that elan1 evaluated but could not stop. A Mode A integration at L1 enforces every write, but its record is checkable only with us until L2. The 16 proof-record fields are the same in every combination; at L1 the signature is absent, not stubbed.
In-process SDK
Mode A · Enforced
Mode A · Enforced
“No write reaches the system of record without a gate decision and a proof record.”
In-process SDK. The kernel holds a single-use credential that lasts 10 minutes; your agents never see it. The system of record accepts only kernel-minted tokens that expire in 10 minutes, and each change goes to a sandbox first. This is the only mode in which we use the word enforced.
- Where it applies today: elan1 Work hosted on ERPNext. Third parties by agreement, after conformance tests C1–C14 pass.
- What the caller does: sends write intents through the in-process SDK and handles the outcome. It never holds a standing credential to the books.
- What happens if elan1 is down: allows stop, and changes wait for a person. Nothing writes without a decision, because nothing else holds the credential.
MCP server · HTTP API
Mode B · Attested advisory
Mode B · Attested advisory
“Evaluated against your rules and recorded.”
Over MCP or HTTP. Your code calls elan1 first; elan1 evaluates the write intent and records it, and cannot stop the write.
- How you connect: the MCP server (34 tools: 18 read, 10 stage, 6 act) or the HTTP API.
- What the caller does: calls
assertbefore writing, writes only on an allow, waits on an escalation, and stops on a refusal. - What is recorded: every attempt, including the ones Govern refused, with the same 16 fields as Mode A.
Mode by consumer
| Consumer | Mode | What we may say |
|---|---|---|
| elan1 Work, hosted ERPNext | Mode A · Enforced | No write reaches the system of record without a gate decision and a proof record. |
| elan1 Work Attach (your ERPNext) | Mode B · Attested advisory | Evaluated against your rules and recorded. |
| elan1 Decide | Mode B · Attested advisory | Writes go to Govern as intents; evaluated and recorded. |
| elan1 Run tooling | Mode B · Attested advisory | Evaluated and recorded. If elan1 is unreachable, the gate check fails closed. |
| Third-party agents | Mode B · Attested advisory (A by agreement) | Mode B, or Mode A by agreement. No claim to run on Govern until conformance tests C1–C14 pass. |
Moving a write type to Mode A
Mode is set per write type, so an integration can move one write type at a time. A write type can move from Mode B to Mode A once elan1 can hold its write credential. Before the kernel takes the credential, we plan to ask for:
- At least 30 days of recorded Mode B traffic for that write type, so refusal and escalation rates are known before anything is enforced.
- A bypass test against the real system: an attempt to write without a gate decision, which must fail once the credential has moved.
- A review of the declaration, the approvers and the fail-closed behaviour with the process owner.
Nothing changes in the record shape when a write type moves. What changes is the claim: from “evaluated and recorded” to “enforced”, for records written after the move.
L1, L2 and L3
Each level answers one question. Each adds to the one before; the write path does not change between levels.
| Level | Question | Evidence | Status |
|---|---|---|---|
| L1 · Guarded | Can I let this run? The write was controlled. |
| Available Available |
| L2 · Attested | Can I hand this over? A stranger can check that. |
| Available Available · signed and checkable offline |
| L3 · Proven | Does this survive the vendor? The record survives us. |
| On auditor acceptance On auditor acceptance · begins when an outside auditor accepts an L2 bundle in writing |
- L1 Guarded is the baseline level of every governed write, available today. Verification at L1 means recomputing digests and comparing
prev_digest; it needs our infrastructure. See Proof record. - L2 Attested adds signing, anchoring to two RFC 3161 timestamp authorities and the free offline verifier. Available today.
- L3 Proven is reached on auditor acceptance. It begins when an outside auditor accepts an L2 bundle in writing, an event we do not control, so it carries no date.
What each combination may say
The sentence an operator, an auditor or your own product may use, for each level and mode, and what it must not imply.
| Level | Mode A · Enforced | Mode B · Attested advisory |
|---|---|---|
| L1 Guarded | “Our agents cannot write to our books without passing rules we set. A person approves anything material. We hold a tamper-evident record of every attempt, including the refusals.” Cannot claim
| “Every write intent our agents send is evaluated against rules we set and recorded, including the refusals. The record is tamper-evident to us.” Cannot claim
|
| L2 Attested | “No write reached our books without a gate decision and a proof record, and here is a signed bundle you can check on your own machine, without our vendor's help.” Cannot claim
| “Every write intent was evaluated against our rules and recorded, and here is a signed bundle you can check on your own machine. It records our system's writes; it did not stop them.” Cannot claim
|
| L3 Proven | “The format is published, so the record can be checked in ten years whether or not elan1 exists, and no write reached our books without a gate decision.” Cannot claim
| “The format is published, so the record of every evaluated write intent can be checked whether or not elan1 exists.” Cannot claim
|
Upgrades and old records
- Moving from L1 to L2 signs only the records written after the upgrade. Records written at L1 stay L1, and are labelled L1 for good. Nothing re-signs history.
- Moving a write type from Mode B to Mode A changes the claim only for records written after the credential moved. Earlier records remain “evaluated and recorded”.
- Signing keys are held per residency domain. India first: domain “in”.
Wording rules for builders
If your product writes through elan1 Govern, the claims you make to your own customers inherit these limits. We hold our own site to the same register.
| Word | Allowed at | What it means |
|---|---|---|
| “tamper-evident” | L1 and above | Any change to a past record is evident to the tenant, because the chain no longer recomputes. |
| “enforced” | Mode A only | Govern holds the write credential, so no write reaches the system of record without a gate decision. |
| “evaluated and recorded” | Mode B (and Mode A) | Every write intent was checked against your rules and left a proof record. |
| “signed” | From L2 | The record's digest carries an Ed25519 signature, one key per residency domain. |
| “checkable offline” | From L2 | An evidence bundle can be verified on an air-gapped machine with the free verifier, without us. |
| “survives the vendor” | L3 (on auditor acceptance) | Only after an outside auditor has accepted an L2 bundle in writing. |
Never used, at any level or mode:
- any word that says a record cannot be altered — we claim that a change shows, not that change is impossible
- any claim of certification, a guarantee or admissibility in court
- “blocked” or “prevented” for a Mode B write
- “runs on elan1” for an agent that has not passed C1–C14
None of the levels makes you compliant with a regulation on its own, proves that a transaction was genuine, or proves that your rules were adequate.
The full register is on What we claim.