Who it is for
Organizations where a decision has consequences, and someone has to answer for it.
Nervos is built for the person who owns the outcome of a consequential decision, the teams who must show how it was governed, and the engineers who would rather not build the epistemics themselves.
Three audiences use the same record. Below, what each gets from it. Nervos has no customers yet, so there are no outcomes to quote here, and none are.
Finance and procurement leaders
You own the outcome. The record makes the reasoning yours to keep.
A vendor consolidation, a renewal, a commitment under uncertainty. The reasoning behind it is usually in a deck, a thread, and someone’s memory. Nervos puts it in one record that outlives the meeting.
You see what was known and how well, what was assumed, what the alternatives were, and what the futures looked like before anyone chose. When the outcome arrives, the record shows whether the prediction held.
- 01
Every figure in the sample record carries its status.
Observed from a system of record, inferred by a model, simulated over assumptions, or pending. In a deployment, the decision record that carries these statuses is off by default.
- 02
Futures are ranges, not points.
P10, P50, and P90 from a seeded simulation, with the assumptions listed beside them. Where predictions are enabled, the range is registered before the outcome is knowable.
- 03
In the sample record, the alternative not taken is kept.
It holds the options that lost, and why, so the next decision starts from the last one instead of from nothing. A deployment’s record does not store alternatives yet.
- 04
- 05
The outcome scores the prediction.
Where enabled, prediction error is recorded and scored. Calibration is reported once twenty predictions have resolved. No screen records an outcome yet.
Regulated and defense procurement
Controls built into the system, not described in a binder.
A purchasing system review asks whether procedures are followed, whether buyers and approvers are separated, and whether the records can be trusted. Nervos makes those properties structural: the database refuses an approval by the proposer on record, and an edit to one ledger step breaks the chain at that step. Neither is complete yet. Until a pending migration is applied, a member can set who is on record (SOD-01). The chain has no external anchor, and until a pending migration is applied anyone holding the service key can rewrite it from one step to the end (HIST-01).
The mapping below is to NIST 800-171 and to the FAR and DFARS clauses that govern contractor purchasing. The full mapping with evidence is available under NDA. Identifiers such as SOD-01 refer to the claims register, which gives each claim’s status in each environment and is described on the trust page.
- Enforced
- a structural constraint, blocking rather than logging
- Partial
- part holds; the row names what does not yet
- Aligned
- the record supports the requirement; a reviewer judges adequacy
| Control | Framework | Requirement | How the record supports it | Status |
|---|---|---|---|---|
| AC-5 | NIST 800-171 | Separation of duties | The approval route and a database trigger refuse an approval by the proposer on record, and the engine checks again before dispatch. Until a pending migration is applied, a member can set who is on record (SOD-01). | Partial |
| AC-6 | NIST 800-171 | Least privilege | Four roles with fixed capability sets. End users cannot write their own role. A role change goes through a server route that checks the caller’s role. In our repository, this control is partial (RBAC-01). | Partial |
| AU-2 · AU-12 | NIST 800-171 | Audit events | Proposals, approvals, rejections, executions, rollbacks, replays and credential changes are audited by the server with caller identity and organization. Audit writes are best-effort: a write that fails leaves a server log line and no row. A ledger step that cannot be written before a send stops the send. One recording a sent write is flagged missing instead. In our repository, a member writes no audit row (AUD-02), and each row the server writes belongs to the organization it concerns (AUD-01). | Partial |
| AU-9 | NIST 800-171 | Protection of audit information | The execution ledger is SHA-256 hash-chained, and members cannot update or delete a row. An altered row, or a deleted row with rows after it, breaks the chain, and anyone with the export can detect it. Removing the last rows, or rewriting every row from one onward, is not detected: the chain has no external anchor (HIST-01, HIST-02). | Partial |
| FAR 44.302 | FAR Part 44 | Purchasing system adequacy | Each proposal carries the rationale its proposer gives and its approval. The ledger of what executed, with each approver and a hash of the parameters, exports as CSV or JSON. | Aligned |
| DFARS 252.244-7001 | DFARS | Contractor purchasing administration | The same record, as a structured CSV or JSON export for DCAA and DCMA review, with parameters hashed. | Aligned |
Purchasing system review
What a reviewer asks, and what the record answers.
Nervos does not certify a purchasing system. It makes the evidence a reviewer needs a by-product of using it.
| The review asks | The record answers |
|---|---|
| Written procurement procedures are followed | The approval workflow is code. A step out of order is refused, not just logged. |
| Sole-source and other justifications are on file | A proposal carries the rationale its proposer gives, stored with it. |
| Buyers and approvers are separated | The approval route and the dispatch check both refuse an approval by the proposer on record. Until a pending migration is applied, a member can set who is on record (SOD-01). |
| Pricing reasonableness is established | Each analysis is stored with its simulated range and the assumptions it rests on. A reviewer judges reasonableness. |
| Records are retained and auditable | The execution ledger is SHA-256 hash-chained and closed to member edits. An owner or admin exports it, and the chain of an export can be recomputed in the browser, with no server round-trip. |
- Held
- NIST 800-171 control mapping · SOC 2 criteria mapping · DPA · sub-processor register
- Published or available under NDA.
- Not held
- No SOC 2 report, no ISO 27001, no CMMC certification, no third-party penetration test
- Mappings, not certifications. Stated plainly so no one has to ask.
- Export
- A structured CSV or JSON export for DCAA review
- Owner and admin roles. Parameters are exported as hashes.
or write to security@thenervos.com
Engineering and platform teams
The epistemics are the hard part. They are already built.
Teams that prototype their own decision stack meet the same problems: confidence that inflates as it is summarized, contradictions that get averaged away, predictions nobody scores, and a write path that is one bug from an unapproved change.
Nervos is the substrate that already answers those. Your team ships the decisions.
- Evidence statuses
- verified · inferred · simulated · pending
- A fifth status cannot be added by a caller. In a deployment, the decision record that carries them is off by default.
- Confidence ceiling
- An analysis is capped at its least-grounded perspective
- The general rule, a belief capped by its weakest source, is proven in tests and not yet wired into production code.
- Contradictions
- Held open, severity scored
- Resolution needs new evidence or a recorded decision.
- Simulation
- Deterministic, seeded, re-runnable
- The seed is on the record.
- Predictions
- Pre-registered, closed to member edits
- Off by default, enabled per deployment. Scored with proper scoring rules when they resolve.
- Execution
- Approval-gated, ledgered
- In our repository, a write is dispatched only under a server-recorded human authorization (AUTHZ-01). Rollback and replay share one engine. In our repository, one approval yields at most one dispatch. Against a NetSuite RESTlet older than 2.2.0, a retried attempt may still write twice, and the ledger records that doubt (IDEMP-01).
- Tenancy
- Row-level security on every table
- In our repository, each tenant table’s policies scope rows to the caller’s organization (TEN-01). The service role bypasses row-level security, so server code scopes by organization itself. Cross-organization isolation is covered by tests that CI is configured to run. The claims register records whether they run (CI-02).
- Approvals in Slack
- Signed requests, role-checked
- No separate console required to approve.
- Public API reference
- Not yet
- The surface is stabilizing. Pilot teams work with the engineer who built the connector.
Talk to us
Bring a decision you have to get right.
A pilot runs 90 days against one real decision workflow in your system of record. Success criteria are agreed in writing before kickoff.