KOMPAS

Trust & architecture

KOMPAS exists to make an institution’s claims about its own performance checkable. A product with that job has to be checkable itself, so this page states how it works rather than how it is positioned. Everything below is enforced in the build, not promised in a deck.

The rules the product cannot break

The ledger is append-only.

A record that can be edited after the fact cannot settle a dispute about what was known and when.

A build gate rejects any UPDATE or DELETE against the events table, in SQL or through the ORM.

Status comes only from accepted evidence.

Otherwise a status is a claim about a claim, and the number on the board is whatever the last optimistic person typed.

Executed status is a derivation over accepted evidence; no code path sets it from user input.

The person who submits evidence cannot be the person who accepts it.

Self-certification is the failure mode every governance system dies of.

Enforced at the validation boundary and asserted by the test suite.

AI drafts. A human decides.

A model that could accept evidence, send a message or close an item would make the ledger a record of the model’s opinions.

No model call writes a status, an acceptance or an outbound message. Every one of those is a human action in the ledger.

Nothing is sent without someone approving it.

A tool that emails an institution’s deans on its own will be switched off within a week, and it will deserve to be.

Drafts queue for approval; delivery passes a mock → allowlist → live arbiter that ships in mock.

When it does not know, it says so.

A confident number over four data points is worse than a blank, because a blank invites a question.

Rates carry their sample size and a sufficiency flag; surfaces render "—" rather than a figure they cannot support.

What counts as proof

Not all evidence is equal, and pretending otherwise is how a tracker fills up with green ticks. Every piece of evidence carries a strength, and the weakest kinds always go to a human rather than clearing on their own:

  • minuted signed — weight 1
  • signed document — weight 0.85
  • sheet row — weight 0.6
  • meeting segment unsigned — weight 0.55 · always reviewed by a person
  • photo only — weight 0.3 · always reviewed by a person
  • declaration — weight 0.25 · always reviewed by a person

Personal and confidential material

Governance documents contain things that must never enter a performance tracker. Text classified into any of these categories is quarantined at intake and does not reach the tracker at all — including on the no-login evidence page, which is the surface most likely to receive something it should not:

  • personnel and medical material, and identity numbers
  • disciplinary matters
  • legally privileged material
  • remuneration

Data stays in the tenant it arrived in. Cross-tenant reads are blocked at the database layer, not only in application code. Any future cross-institution comparison is limited by design to aggregates — the export surface carries no person, no name and no item title, so an identifiable version cannot be shipped by changing a setting.

What is switched off

KOMPAS ships with the consequential switches off, and turning one on is a deliberate act by the customer’s own owner — never a default, never a silent upgrade:

  • Outbound email is in mock mode. Messages are drafted and queued; nothing leaves the system until an owner supplies credentials and an allowlist.
  • External connectors (SharePoint, Google Drive) are read-only and inactive until an administrator supplies credentials. KOMPAS never writes back to a source system.
  • Meeting transcription is not a feature and will not be. Recording a committee changes what people are willing to say in it.
  • Contained tenants (mahsa, pilot) are the only spaces permitted to hold real institutional data during a build or evaluation, enforced in code.

Plans

Audit

A one-off execution audit of a single committee, delivered as a report.

up to 1 committees · up to 500 KPIs · shared sign-in

Pilot

A running loop for a faculty or a small set of committees.

up to 8 committees · up to 2000 KPIs · shared sign-in

Enterprise

The whole institution, its own identity provider, no ceilings.

unlimited committees · unlimited KPIs · your own identity provider

A plan limit refuses a new committee or KPI. It never hides one you already have, and it never withholds your export. An institution’s own governance record is not leverage.

If you are evaluating this

The useful test is not a demo. Take one real committee, load its last four meetings, and see how many of its actions KOMPAS can show as proven rather than merely reported. The honest answer on the first run is usually uncomfortable, and that is the point — the gap it shows you is the gap that was already there.

This page describes the architecture as built. Where it and the code disagree, the code is right and this page is a defect worth reporting.