Seven rules.
They cost.

Each rule takes something away.

These are not guidelines. They are the constraints every Sign has to satisfy before it counts as one, published in full below, in the order they apply.

1. › 01The Moment A Sign is the moment a named party becomes answerable for something.

   Accountability is not a quality a document has. It happens, at a particular second, to a particular person, and answerable means named in the record as the party who decided, not liable at law. Most systems record only that work was completed, which is a different fact: the question in an examination is never “was this done?” but “who was answerable, and were they entitled to be?” If nothing changed about who is answerable, no Sign was created.

2. › 02The Exclusions A signature that could be given for anything warrants nothing.

   An approval button someone renamed.

   A line in an activity log.

   A score above a threshold.

   A review that no individual owns.

   Four things get called signing. None of them is one.

   The distinction is between observation and answerability. An activity log is built never to refuse a record, which is exactly why it cannot carry a signature; a ledger of accountability has to be able to refuse the invalid ones. No single store can hold both contracts, so we keep two.

3. › 03The Warrant Every Sign states what it warrants, drawn from a closed list of five.

   OUTPUT VALIDATED TRANSITION CONFIRMED CONFIGURATION ACTIVATED ARTIFACT RELEASED RISK ACCEPTED

   Closed means five, not five and whatever the next integration needs. A sixth would require amending this standard, itself a signed act (Rule 07), and roles don't multiply warrants: a maker and an approver signing the same output both warrant OUTPUT VALIDATED, with the position each signed from recorded as a separate fact (Rule 05). What nobody can reconstruct from a free-text comment field is what the approver believed they were approving, which is the reason we bother.

4. › 04The Signer A signer is an identity, not a name: a human carries designation and certification, an agent carries a grant.

   Humans hold signing authority. Agents hold a grant of it: scoped to a work class, time-boxed, revocable.

   It delegates. It never abdicates.

   The name answers who became answerable; the designation and certification answer whether they were entitled to be, and authorisation is written against those, never the name. An agent's grant is issued by a named person, covers one work class, carries an expiry date, and is withdrawn on breach or drift, a permission somebody gave and can take back, which is why an Approver slot never resolves to an agent. What we store is the signer as at the moment of signing, so a lapsed authorization today does not reach back and unsign what was valid when it was current.

5. › 05The Separation Every Sign is given in one of three roles: Maker, Reviewer, Approver.

   No identity fills two roles on the same object, including the agent that produced it.

   Maker

   PRODUCES THE WORK
   Human, or agent under a grant

   Reviewer

   CHECKS IT
   Distinct identity, required by policy

   Approver

   SIGNS IT
   Never the identity that made it

   How many of each is set by policy and written in designations, not names: high-volume work takes one Maker and one Approver, work carrying real exposure takes a Maker, two Reviewers and two Approvers. A case escalates when no eligible identity is available for a slot — work outside the grant, evidence that failed its checks, confidence below the declared threshold — and we ship a default ladder as a starting point, not the standard:

   AI → Analyst → Manager → Institution

   Nobody chooses the signer. The policy does, and that policy is itself versioned and signed (Rule 07).

6. › 06The Record Every Sign sits on SignChain, and nothing in it can be rewritten after the fact.

   A correction is a new entry. A re-sign is a new signature. A decline is one too.

   SIGNCHAIN · EXAMPLE RECORD 5 ENTRIES · APPEND-ONLY

   10:02:14RUNDraft produced · within grant · ONX-AGENT-11

   10:14:07CHECKCorrection recorded · original entry retained, not overwritten

   10:19:41DECLINEDeclined · reviewer · reason recorded on the object

   11:03:52CHECKRe-reviewed after correction · cleared

   11:08:19SIGNSigned · distinct identity from Maker and Reviewer

   Once a record is closed you may add to it, documenting what you added and why, but you never reach back and alter what's already there. Recording declines matters more than it sounds: a system that stores only approvals can't demonstrate that anyone ever refused, which is the fact you need when the question is why work didn't proceed. Each Sign also points at the evidence it rests on: two records, one deliverable, joined rather than reconciled.

   See the record on a live Sign →
7. › 07The Amendment Changing these rules is itself a Sign.

   Every version stays published and dated. When a rule changes, the change is written to the same record it governs, warranted CONFIGURATION ACTIVATED, under the same filled slots required of anyone else (Rule 05). We ask you to accept that a change in behaviour should carry a signature, and it would be odd to exempt our own.

These rules apply to every Sign OneNexus produces, in every deployment. Cloud, on-premises, hybrid. The rules do not get shorter when the software moves into your building. This is a published house standard, not a standards process. We publish it so it can be used against us.