The architecture,boundaries andintegration model.

Institutional Role Nodes, a Role-to-Role lifecycle protocol, the Control Decision Envelope, a shared proof & receipt layer, and execution / interoperability adapters. KATLAS records the governed action — it is not a central store of raw private evidence.

A standardisable object consumed before a consequential action executes, expressing authority, policy, evidence references, decision and privacy boundary. Outcomes: allowed, blocked, review required, released, refused.

Evidence remains with its custodian. Only metadata, roles, permissions and evidence references cross the boundary. Raw private data and withheld assets are never sent to the node.

Stakeholder-defined roles, mandates, scopes and purposes. Authority gates are explicit and visible. Policy and current-state conditions are evaluated at the point of action. Institutional policy and authorised roles decide; KATLAS makes that boundary executable.

A public-safe receipt records who acted, when, under what authority, which evidence references were used and what was withheld — with a verification status. Full signed envelopes are not exposed publicly.

Conceptual patterns only — REST APIs, backend-only authentication, execution adapters, and event / webhook integration where actually supported. Standards examples where relevant: ISO 20022 (value movement) and FHIR (health records). No specific production APIs or connectors are claimed here.

Any node credential is backend-only (server-side). The public website never holds or requests it, never calls the signing node, and never generates signed receipts. Legacy credential aliases are prohibited.

Showcase, governed sandbox and pilot. Simulated operation demonstrates governed journeys with synthetic data; live-node operation is provisioned separately and never runs on the marketing site.

A synthetic but realistic governed journey with separate role identities and devices. Access is provisioned on request via a governed process — not self-serve — until automated, governed provisioning exists.

One bounded problem and one consequential handoff, with agreed acceptance criteria and the measurement framework below. Outputs: role-network blueprint, receipt model and operational acceptance evidence.