Risk acceptances, document reviews and the agent's proposals land in one inbox. The right people decide, nobody approves their own request, and every decision is written to a tamper-evident history.
The chasing and the paper trail come with the workflow.
01
Protection assessments, changed documents and scheduled reviews show up in one inbox when they are due, instead of in calendar reminders and email threads.
Scheduled reviews appear when their 30-day window opens; the open inbox rechecks every 10 minutes.
02
Risk acceptance needs two different approvers. Staged approvals check each stage's role and order. No reminder spreadsheet needed.
Separation of duties is built into the shared approval core: the requester can never decide their own request.
03
When the agent suggests a change, it becomes a proposal with an expiry. Only after a person approves it does Secani carry it out.
Proposals expire after 24 hours by default and at most after 7 days; the agent's authority is checked again on execution.
The reminders, the follow-ups and the evidence of who agreed.
Chasing reviewers by email
Due reviews appear in the reviewer's inbox
Tracking review dates in a spreadsheet
Scheduled reviews open their own 30-day window
Keeping signed PDFs to prove a risk acceptance
Each approval recorded with who decided and when
Copying AI suggestions into records by hand
Approved proposals are carried out for you
How much time goes into following up on sign-offs?
Hours per year spent chasing sign-offs
50
Your numbers, multiplied: approvals × minutes. Nothing of ours goes into the result.
The rules an auditor asks about are enforced, not promised.
A requester can never approve their own request, and in dual control the same person cannot approve twice.
Decisions are written in the same transaction as the change, into a SHA-256 hash chain whose integrity can be verified.
An unapproved proposal from the agent expires instead of waiting forever, and its authority is checked again before it runs.
No. The shared approval core rejects a decision by the requester as a violation of separation of duties.
Risk acceptance and resolution cases use dual control with two different approvers. Staged approvals can require several stages with their own roles and counts.
Scheduled document reviews, changed documents and protection assessments appear in the responsible person's inbox when their 30-day due window opens.
Every decision is recorded with its actor and time in an append-only SHA-256 hash chain, written in the same transaction as the change.
Let the workflow ask, record and remember.
