The modules behind the engagements

A pipe is a declaration, not a script: source, schedule, expected shape, and tolerance live in the tenant seed. The held SS&C pack is the module doing its job — yesterday's good data stands until today's arrives whole.

The incident feed shows the SS&C hold at 06:20 with who was told and when. An alarm that fires into a log nobody reads is the same as no alarm — every rule names a person-visible destination.

A break carries its two sides and its age. Three days old, it stops being a line item and becomes somebody's morning — the escalation is in the module, not in someone's memory.

The trace is generated from the run record, never typed. If a figure cannot produce this chain, the report build refuses it — a number that cannot name its source does not ship.

Coverage is judged from the registry, so a system missing from the list is a visible gap, not an invisible one. Key custody checks the backup key matches escrow — a stale key restores an identity everyone already stopped trusting.

Which model, which version, what changed, who signed — answered from the log, not from memory. Configuration changes ride the same rail as model changes, because a config change can move a number just as far.

A held report says why, on its face. Shipping a report built on a short delivery would be the silent failure every other module exists to prevent.

The trail is append-only: who filed, who viewed, what superseded what. Nothing is deleted — a superseded policy is archived with its history, which is exactly what a due-diligence exam wants to walk.

Service accounts get the narrowest role that works — the backup seat reads everything and writes nothing. The review column carries a date because "we review access" without a date is a sentence, not a control.