Access follows the job. A judge reads the docket, a clerk files, a treasurer approves, and no one sees more than their role calls for.

The AI does the legwork, then a person approves before anything is recorded as final. The tribe stays in control of every decision.

Every approval is itself a record that proves itself, so it is always clear who authorized what.

Absent, not forbidden

Most systems answer a request for a record you are not cleared to see with a refusal. That refusal is itself information: it confirms the record exists, and it tells a curious or determined person exactly where to keep pushing.

Where the governed record is read, this system answers differently. A matter outside your scope does not appear at all: it is absent rather than refused. The lists agree, the counts agree, and looking the matter up directly agrees, so there is no map of the government's sensitive business to be assembled by noting which doors are locked.

The default is nothing. Access exists only where it has been granted, so a new account starts with no reach at all and is given exactly what the job requires.

A staff member who is not cleared for a matter is not told that access is denied. The matter is simply not there. What does not appear also cannot be counted, probed, or inferred.

Three levels of authority, granted deliberately

Authority is not one switch. Being able to read a matter, being able to approve an action on it, and being able to take that action are three different powers, and most of the trouble in government systems comes from bundling them.

Level of authority	What it means	Typical use
View	See the matter, change nothing	A judge reading a docket, an auditor reviewing a year
Approve	Sign off on an action a person or the AI has prepared, up to a ceiling you set	A treasurer approving a disbursement, a supervisor approving a filing
Act	Carry the action out	A clerk filing, an enrollment officer recording a decision

Grants can be limited in time, narrowed after the fact, and revoked. Every grant is appended to a permanent ledger and sealed to the audit chain, so who was given what, by whom, and when is answerable.

Access and approvals, from each seat

Tribal IT

Default-deny, and grants that expire.

Nobody starts with access to anything. Grants are given for a scope and a period, can be narrowed or revoked, and every one of them is a sealed record. Offboarding is an action, not an audit.

Council

Sensitive acts need a human sign-off.

The AI prepares; a person authorizes. Money cannot move on the system's own initiative, and every approval names the person who gave it. The tribe keeps every decision that matters.

Staff

Your screen holds your job, and not more.

You see what your work requires without wading through the rest of the government, and nobody can quietly act in your name, because every action carries its author.

The stop, and the stop that cannot be overridden

For anything sensitive, the system prepares the action, shows the person exactly what will happen, and waits. The approval is recorded as a sealed record of its own, so the question of who authorized what is never a matter of recollection.

Behind that sits a harder control. A kill switch stops the system from acting, either immediately or after it finishes what it is doing, and it cannot be disabled. It is not a configuration option that a compromised account could quietly turn off. It is a floor.

Nothing is final without a person. The AI gathers and drafts; a human approves.
Every approval is a sealed record. Who authorized what, and when, is provable rather than remembered.
Money moves only on request. The system can ask for a payment; it cannot send one, and a second person has to approve it downstream.
Grants expire, narrow, and revoke. Access is a deliberate act with a lifespan, not a permanent condition.
The kill switch cannot be turned off. One action halts the system, and no account can disable that.

Questions tribes ask about access

Can we match this to our own offices and titles?: Yes. Access is described in terms of what a job needs to see and do, so it is set up around your government's actual roles rather than a vendor's idea of them.
Who watches the administrator?: The record does. An administrator's actions are sealed and attributed like everyone else's, and granting access is itself a recorded act, so the powerful account is the one that leaves the clearest trail.
What happens when someone leaves?: Their access is revoked as a normal action and their record of what they did remains intact. The history does not leave with the person.

Roles and approvals built in