Governance and policy
Policy authoring and publication are separate from runtime policy evaluation. The console projects the configured policy service's results or its explicit dependency failure; the presence of a page is not proof that policy compute is active in a particular environment.
Policy authoring
Open Policy-as-Code to list, create, update, validate, and dry-run policies. When AP00019 Policy Compute is configured, authorized operators can also compile, publish, and roll back signed policy bundles.
The authoring contract supports Rego and IAM-style JSON source. Organization and workspace scope IDs are derived from the verified session at Edge; callers choose the cascade level but cannot supply a different tenant ID. Read operations require an authenticated workspace member. Writes are enforced server-side for SUPER_ADMIN, ORG_ADMIN, and—at workspace scope—WORKSPACE_ADMIN.
Policy evaluation can allow or deny a request according to the active bundle. Osyra does not currently claim that arbitrary PII is rewritten before provider dispatch, that every policy decision completes under one millisecond, or that every inference produces a signed receipt.
Workspaces and roles
Workspaces is the real console surface for creating and managing workspace boundaries. API-key operations and model requests use organization and workspace claims verified at the server; a caller-controlled request field cannot move a credential into another tenant.
The canonical IAM role vocabulary is:
SUPER_ADMINORG_ADMINWORKSPACE_ADMINWORKSPACE_USERWORKSPACE_VIEWERAUDITORBILLING_ADMINfor provisioned billing authority
Exact capabilities come from the permission claims and the server-side operation gate. Documentation does not translate these names into a broad client-side role table, because doing so can grant or promise authority that the API does not.
Cost and budgets
Open Cost & budgets to read measured spend and manage real Billing budget records. The GraphQL contract supports organization, workspace, provider, and API-key scopes, exact integer-cent ceilings, alert thresholds, and SOFT or HARD mode.
Budget reads and writes require the corresponding billing permission. Mutations are re-authorized at the Billing service for ORG_ADMIN, BILLING_ADMIN, or SUPER_ADMIN; the browser gate is not the security boundary. The console fails closed to a not-wired banner if that bridge is unavailable and never invents a budget row or utilization figure.
A stored hard-mode budget is not, by itself, proof that every model route in the current environment stops at the ceiling. Verify the complete request-time enforcement path before treating a budget as a guaranteed 429 control. Enterprise remains soft by default unless the signed contract and deployed policy say otherwise.
Audit events, exports, and receipts
Audit reads AP00005's workspace-scoped audit-of-record when the Audit service is configured. The server derives the workspace from the access token and returns an explicit OSY-AUDIT-NOT-WIRED state instead of fabricated rows when the dependency is absent.
Authorized operators can request a signed .audit.zip range export from the Evidence explorer. Assign the IAM RBAC grant audit:export; IAM projects it into the access token as osyra:audit:*:export, which is the permission Edge requires before it calls the separately authorizing AP00005 export path. A token carrying only the bare IAM grant string is rejected at Edge. The auditExport mutation returns a short-lived download receipt when that path is wired. The Evidence explorer is the shipped export route; the Settings area has no separate audit-export destination.
Receipt-producing operations expose their own receipt IDs and wire formats. The authenticated receipt(id:) query returns a persisted VIR receipt only when it exists in the caller's workspace, together with the authoritative verification result and signed bytes. A model response ID is not a receipt ID, and Osyra does not promise one generic receipt for every API request.
Warehouse and SIEM delivery
Warehouse egress is the intended destination-registry surface for customer-owned sinks. It must show OSY-WAREHOUSE-NOT-WIRED until its AP00005 registry and Edge bridge are enabled. Do not describe Splunk, Datadog, Snowflake, Elastic, S3, Kinesis, delivery cadence, or a signed stream as active merely because the page or design exists.
Compliance evidence
Compliance maps real control evidence to SOC 2, ISO 27001, and HIPAA views when the compliance bridge is wired. The Trust center is the public source for Osyra's current corporate certification and legal-readiness status.
The console does not issue an Article 12 attestation letter, certification, BAA, or legal opinion on demand. The Settings area has no compliance-attestation route. Treat a not-wired export or missing evidence as unavailable—not as a passing control—and use a signed agreement for any customer-specific compliance commitment.
What's next
- Authentication — credentials and tenant boundaries
- Errors — policy and dependency failures
- Multi-provider routing — provider-selection behavior