Governed Actions & Read-Only Guard

OrviQ Assistant is intentionally designed as an advisory and explanatory system, not an autonomous agent with permission to mutate compliance records.

---

Read-Only Guard

If a user prompts the Assistant to perform a governed state change (e.g., "Approve this mapping", "Close this finding", "Mark requirement 5.1.2 as compliant", or "Publish policy POL-0003"), the Assistant refuses the mutation:

"I can explain the decision and open the relevant workflow, but the action must be completed through OrviQ's governed approval process."

The Assistant provides a direct deep link to the Approvals Hub (/approvals) or the relevant record workspace where an authorized human user can execute the decision.

---

Governed Actions Requiring Human Sign-Off

• Approving or rejecting Crosswalk Mappings
• Changing Requirement compliance determinations
• Publishing or archiving corporate policies
• Granting risk exceptions or accepting residual risks
• Closing audit findings or verifying remediation action plans
• Modifying RBAC roles or security configurations