Abstract
Governance in an inter-organisational, commercial context has to survive scrutiny it cannot anticipate. This paper describes GateHouse’s ABAC engine, the dual enforcement / attestation model, and why a formally-verifiable policy language turns governance from assertion into proof.
ABAC for deals
Access decisions are attribute-based: jurisdiction × purpose × buyer classification × consent state, and more. This is not role-based access inside one org; it is inter-organisational and commercial, tied to deals, counterparty classification and purpose-bound licences.
Enforcement mode
At the boundary, the policy is the gate. A pending release is evaluated against the relevant attributes and permitted or blocked. Sellers may start restrictive — human-approved egress only — and open specific output classes to automation as trust builds.
Attestation mode
The same policy, run in attestation mode, proves what a release did or would disclose. This changes the regulatory conversation: you present a proof derived from the policy, not a binder describing intentions.
Why formal verification
Cedar was selected chiefly for its formal-verification properties. A policy you can analyse is a policy you can make guarantees about. For a boundary whose value is that its guarantees are checkable, a language that trades some expressiveness for decidable analysis is the right instrument.
Templates & simulation
A library of jurisdiction, purpose and product templates accelerates authoring; policy simulation runs a candidate policy against real data inside the container to answer “what would this release?” before it is enabled. The editor shows commercial impact inline: which datasets a rule makes invisible to buyers.
Audit as settlement-grade evidence
Every decision — policy version, attributes, outcome — is logged to an audit trail built to settlement-grade standards. Version diffs record who changed what, when, and its effect. Governance and money share one evidentiary base.