Four eyes belong in the change. Not in an inbox.
Months later an auditor asks who approved that limit override, and why. The answer should be the change itself, not an email thread.
The systems you already run, the objects your product declares, and the work your team gets back.
These marks name the kinds of system a source declaration reaches — a picture of the ecosystem, not a fixed menu, and nothing here implies a partnership.
Stop reconstructing decisions. Start recording them.
Books of record stay put
Core banking, custody and risk stay authoritative; Bijection reads them on a schedule and holds no write credential.
Four eyes, in the change
An Action refuses to apply until a second person approves those exact effects, not a summary of them.
Evidence, not a screenshot
Author, inputs read, effects applied and approver land in an append-only ledger the application itself cannot edit.
What teams build. On day one.
Four places this work turns into declared objects, governed reads, and reviewed changes.
Break queue
Breaks and unmatched items become objects with declared resolutions. Clearing one crosses an Action, not a manual fix in whichever system was reachable.
Limit override
An override above a desk limit is an Action that parks. The approver sees the exposure it was based on before releasing it.
Client file
One Function returns holdings, agreements, open requests and missing documentation from the systems that own each, every figure naming its capture.
Periodic review
A client review is a Workflow that waits for the sign-off it needs, so an open review has a state rather than an owner.
How it runs. End to end.
The same path every product takes: connect what exists, declare what it means, then publish the reads and the changes.
- 01
Capture the books of record read-only
Each system is copied on the cadence you set, and every read resolves to one exact copy. A number on a screen is therefore attributable to a named capture, not to an overnight job nobody owns.
- 02
Declare the objects, and who may see them
Client, account, position, limit, exception: typed properties, declared relationships, declared visibility. Which desk can discover which record is a decision somebody wrote down, not a default inherited from an admin panel.
- 03
Put the second pair of eyes inside the Action
Every consequential change declares its effects in advance. The ones that warrant a second signature hold there until someone other than the author releases those exact effects, and the release joins the record rather than a mailbox.
- 04
Give agents the same doorway
An agent clearing breaks sees what an operations analyst sees, through the same Functions, and can move nothing without proposing a declared Action. Its ceiling is the delegating person’s, narrowed, and the same review thresholds catch it.
Common questions.
No, and be wary of any platform that says it does. Compliance is your obligation and your regulator’s judgement. What you get are mechanisms an audit leans on: an append-only ledger of executed changes, review before consequential effects, recorded authority for every actor, and a single-customer deployment with its own database, storage and identity organisation. Whether those satisfy a particular obligation is your control owners’ call, and we hold no certification that answers it for them.
Only where your product source declares it. Inference is a named step inside a Function, never an ambient capability, and an agent can propose a change but cannot apply one outside the Actions you declared, under the review rules you set. It is still a call to an external provider, so which data class you allow into it stays your decision.
You have several, each describing writes to its own system, so reconstructing a cross-system decision means correlating timestamps and hoping. An Action is recorded once at the level of the decision, with its inputs, its effects and the approval that released it. The per-system trails stay exactly where they are; you stop needing them to infer intent.
Bring us a process.
We'll build it with you.
A business process, the systems it touches, and the rules it needs to follow.