Policy as Code
Hard guardrails at the DB level
Headless Governance for the AI Era
Let your teams and AI do their jobs
Let your teams and AI do their jobs
without breaking the rules.
Policy as Code. Audit Ledger. Full Data Control.
It’s the source of truth your AI can’t argue with.
Headless Governance
Unlock the true potential for your teams.
Demonstrating trust to customers and prospects is critical to closing deals.
Governance Layers
4 Layers to Control Data Inputs
4 layers of governance control every data input — from enforcement to database.
Data Flow
Agents, Workers & APIs → Database
Every write passes through the governance layer before reaching your database.
17 invalid journal entries blocked
5 duplicate invoices prevented
Policy as Code
AI advises. ERP enforces.
Soft guardrails understand nuance. Hard guardrails block bad writes at the database level. No CFO will tell an AI agent "do whatever you want."
D
Database Guardrail
Binary validation at the DB layer
sanka.policy.yaml
// sanka.policy.yaml
rules:
expense_dining:
trigger: "INSERT on expenses"
condition:
- field: "per_person_cost"
operator: ">"
value: 10000 # JPY
- field: "receipt_image"
operator: "is_null"
- field: "director_signature"
operator: "is_null"
action: REJECT
message: "Requires receipt + director sign-off"- AI (soft) understands nuance like "entertainment expenses should be within common sense" and advises the requester.
- ERP (hard) executes binary validation. If per-person dining exceeds JPY 10,000 and receipt or director signature is missing, the write is blocked.
T
Third-Party Rule Engine
Independent final DB write authority
rule-engine.ts
// approved write path
const result = sanka.enforce({
policyVersion: "v3.2.1",
source: "erp_server",
immutableLog: true,
requiredApproval: ["cfo", "director"],
});
// result.status: "blocked"
// result.reason: "Budget exceeded by JPY 1"- Deterministic, not probabilistic. AI can suggest "tax law changed, rewrite logic," but if that logic is wrong, responsibility still exists.
- Immutable on the third-party side. If AI can rewrite DB schema arbitrarily, audit firms cannot sign off. Final commit authority stays in an independent rule engine.
Audit Ledger
Audit time travel. Built in.
A year later, you may not remember "why this calculation happened." With Sanka, you can replay exact logic, permissions, and context from any point in time.
V
Versioned Logic
AppLog with full context preservation
v3.2.1 Current
2026-02-12
permissions
tax_rates
allocation_logic
approval_chain
v3.1.0 Jan snapshot
2026-01-15
v2.9.4 Q3 audit
2025-11-03
- Freeze the versioned logic itself. Store permissions, tax rates, allocation logic, and approval logs exactly as they were at that moment.
- Trusted timestamps. Sanka signs "this data was sealed in this state on [date]" to increase evidentiary value.
I
Immutable Snapshots
WORM - Write Once, Read Many
WORM PROTECTED
WRITE
0xa3f8...c21d
2026-01-15T09:00:00Z
SEALED
READ
0xa3f8...c21d
2026-02-12T14:32:11Z
VERIFIED
DELETE
-
2026-02-12T14:33:00Z
REJECTED
Signed by Sanka (third-party) - Retention: 7 years - Tamper-proof
- No modification. No deletion. WORM technology prevents changes during retention. LLM-generated code cannot bypass this record.
- Third-party sealed. Even if models evolve, you do not lose the "WHY" behind data decisions.
Full Data Control
Fine-grained access. Zero trust.
Dedicated user management for internal teams, external partners, and auditors. Pull data from anywhere. Run jobs serverlessly.
R
RBAC
Role-Based Access Control
User Management
CFO
read
write
approve
export
All ledgers
Auditor
read
Snapshot v3.2.1 only
AI Agent
read
suggest
Policy-gated writes
Partner
read
Allocated projects
- Auditor ReadOnly portal. Issue time-limited API keys with access scoped to a specific snapshot.
- Time-limited API keys. Grant external access that expires automatically and remains policy-gated.
S
Integrations and Serverless
Pull data in. Run jobs out.
Snowflake
Databricks
AWS S3
GCP BigQuery
Serverless Tasks
monthly_reconciliation
4m 32s
tax_calc_batch
12m 08s
audit_snapshot_export
1m 15s
- Bring your own data. Pull from Snowflake, Databricks, or cloud storage while Sanka enforces policy and audit layers.
- Long-running jobs and batch processing. Run reconciliation, tax calculations, and export tasks serverlessly with full audit trails.
The last governance layer LLMs will ever need.
Stop rebuilding auth, audit, and access control for every project. Sanka gives you enterprise-grade infrastructure out of the box.
npx create-sanka-app my-project
