Building apps
Governance & promotion
No app reaches production on the say-so of the person who built it. Every version walks a fixed promotion pipeline, and each gate is an independent human sign-off recorded as a cryptographic signature over the exact contents of that version. This is the control that lets the platform be fast for Champions and still defensible to the second line and the regulator.
The pipeline, stage by stage
A version moves through these states in order, and it cannot skip one.
- DRAFT — the Champion is still building. It runs only in the sandbox, against no production sink.
- TECH_STANDARDS_REVIEW — a technical reviewer checks the graph: sound connectors, sensible nodes, no unsafe patterns.
- BUSINESS_RISK_REVIEW — a business-risk reviewer checks what the app does to the book: materiality, model risk, who is on the gate.
- APPROVED_FOR_PROD — both reviews have signed off. The version is cleared but not yet live.
- PROD — the version is promoted and is the one that runs. The moment it goes live is itself an audited event.
The $50M / high-risk L3 rule
The depth of review scales with what is at stake. A small, low-risk app clears on the two standard sign-offs. But if an app can move more than $50 million of notional, or touches a high-risk area — a Level 3 hard-to-value position, an autonomous model action — it requires an additional, senior third-line (L3) approval before it can be promoted. The threshold is a rule in the platform, not a guideline in a memo: below it two signatures suffice; at or above it the system will not let the version reach PROD without the third.
Why the sign-offs are cryptographic
Each approval signs a hash of the exact version being approved. Change one node afterwards and the signature no longer matches — so "approved" always means "approved this, precisely this". You can prove months later that what is running in production is the artefact three named people signed, not a quietly edited cousin of it.
Good to know
A reviewer cannot sign off a version they authored — separation of duties is enforced, not requested.
Promotion is append-only history: superseding a PROD version records the change, it never erases the one before.