From business signal to accountable outcome
ZoikoSuite connects source records, entity and jurisdiction context, policies, responsibility, human authorization, controlled execution, evidence, and continuous assurance in one governed operating flow.
How does ZoikoSuite work?
ZoikoSuite works by bringing business context, policies, roles, approvals, evidence, integrations, and analytics into one governed action lifecycle. A signal is scoped to the correct entity and jurisdiction, evaluated against configured controls, reviewed by authorized people, executed through permitted identities, recorded with attributable evidence, and monitored for obligations, exceptions, and follow-up.
Context before decision
Entity, jurisdiction, function, object, deadline, and data classification.
Governance before execution
Policy, authority, approvals, segregation, and evidence requirements.
Human accountability
Permitted decisions, reason capture, authorization, and escalation.
Evidence after action
Source linkage, event timeline, integrity, retention, and monitoring.
Nine stages connect the signal, decision, action, and evidence
Each stage names its input, the system's work, the human responsibility, and the output. Every stage can raise an exception; none of them can skip authorization.
Capture the signal
Register the trigger, source, affected object, deadline, proposed objective, and initial evidence requirement.
Establish context
Resolve entity, jurisdiction, function, system, data classification, policy scope, and responsible owner.
Evaluate governance
Identify applicable policies, obligations, authority, segregation rules, evidence requirements, and coverage limitations.
Build the proposed action
Present the requested action, affected records, before and after values, reason, sources, uncertainty, conflicts, and missing information.
Route responsibility
Assign preparer, owner, reviewer, approver, executor, auditor, deadline, delegation, and escalation path.
Review and authorize
Authorized people approve, reject, request evidence, edit within permission, defer, or escalate.
Execute safely
A permitted user or service identity performs the approved action with scopes, idempotency, validation, and reconciliation.
Preserve evidence
Create an attributable evidence manifest and immutable event record linking sources, decisions, actors, and outcomes.
Monitor and improve
Track obligations, exceptions, control performance, evidence health, follow-up, and approved configuration improvement.
Start with an attributable signal
A governed action begins with a recorded trigger and a named source — not an unstructured task or an opaque suggestion.
Establish the context before evaluating the action
Governance cannot be evaluated until the platform knows which organization, entity, place, function, object, system, and data class the action belongs to.
Evaluate the rules that govern this action
Ten control types are resolved against the confirmed context — each with a source authority, an effective date, a scope, an owner, and a review status.
Make the proposed action reviewable before it becomes executable
There is no execution control on this screen. A reviewer sees the change, the reason, the sources, the conflicts, and what is still missing — in one place.
Route the work to the right responsibility and authority
Responsibility, approval authority, and execution permission are separate things. Collapsing them into one "owner" field is how approval controls fail.
Give authorized people the evidence and choices required to decide
Only permitted decisions are active. Unavailable choices state why. Every decision captures a reason and produces a receipt that outlives the confirmation message.
Execute only what was authorized — and record exactly what happened
Execution uses the approved version only. Retries reuse the same idempotency context. Partial completion triggers explicit recovery, never a silent retry.
Preserve the evidence behind the action and decision
A permitted reviewer should be able to reconstruct the signal, context, rules, people, decisions, execution, and outcome — without relying on a narrative written after the event.
Keep the outcome governed after execution
Execution is not completion. Obligations, evidence health, exceptions, and control performance continue — and configuration only changes through an approved route.
Exceptions remain visible, owned, and recoverable
Thirteen failure modes, each mapped to the stage that detects it, the owner who resolves it, and the recovery the platform permits. No exception disappears because the primary workflow advanced.
AI can assist the lifecycle without owning the decision
AI assistance is available at stages 1–5 and 9. It is absent from stages 6 and 7 by design: authorization and execution are not AI functions.
Cross-border vendor payment change
A UK entity proposes changing a vendor payment from £180,000 to £245,000 under a supplier contract administered by the US parent group. One action, nine stages, three human decisions, two exceptions.
An AP ledger event and a contract amendment arrive within four minutes of each other. A correlation ID links both sources to one governed action; the duplicate signal is linked rather than executed twice.
Entity resolves to Zoiko Europe Ltd; function to Accounts Payable; classification to confidential commercial. Jurisdiction conflicts — the entity is UK-domiciled but the contract is administered under US parent terms. Legal selects the governing jurisdiction rather than the system guessing.
Six controls apply. The amount exceeds the local approver limit of £200,000. Contract obligation CO-2214 requires legal review of the amended terms. Segregation prevents the preparer from approving. Evidence rules require the amendment plus supplier verification.
The proposal shows three changed fields — amount, payment date, and creditor bank account — with reasons and sources. The bank-account change is flagged high risk and evidenced only by an email. Missing tax validation is shown, not hidden.
AP preparer, AP manager as reviewer, General Counsel delegate for legal confirmation, Treasury Director as approver, a payment service identity as executor, and a compliance observer. The AP manager can review but cannot approve.
Legal confirms the amendment at 15:04. Treasury first requests evidence rather than approving — the bank-change call-back record is missing. AP completes verification and tax validation. Treasury then approves version 4 at 15:22.
The instruction is sent through the permitted bank connector using the authorized version and an idempotency key. A gateway timeout triggers a retry on the same key; the duplicate is prevented. The gateway acknowledges, then read-back shows a settlement date three days later than authorized.
The manifest links the amendment, call-back verification, tax validation, all three decisions, the policy sources, the payment instruction, the acknowledgement, and the before and after values. One restricted source is excluded from the audit export and labelled as excluded.
Settlement confirmation is tracked to 11 August. The value-date variance stays open with Treasury as owner. The bank-change control fires for the third time this quarter, so Compliance raises a configuration improvement proposal — which requires an authorized owner, testing, and approval before it changes anything.
One action. Seven views. The facts do not change.
Each role sees the same action ID, source, context, and event history. Visibility and permitted decisions are what differ — and the platform explains why.
CFO / FINANCE LEADER
Portfolio value, authority thresholds, approvals, cash impact, control exceptions, evidence health.
Sees full financial context. Can approve within £500,000 as escalation owner. Cannot alter the contract record.
GENERAL COUNSEL
Contract source, obligations, jurisdiction, delegated authority, legal review, evidence, and professional boundaries.
Resolves the governing-law conflict and confirms CO-2214. Cannot approve the payment amount.
CIO / PLATFORM ADMINISTRATOR
Integration, service identity, scopes, execution health, environment, security, deployment, data and event status.
Sees svc-bank-02 scopes and the retry. Cannot approve a business action without delegated authority.
CHRO / WORKFORCE LEADER
Payroll and HR actions, purpose-limited data, policy, approvals, evidence, workforce compliance, privacy.
No visibility — this action is outside the workforce purpose limitation. Purpose limitation is enforced, not advisory.
COO
Cross-functional queue, ownership, deadlines, bottlenecks, exceptions, recovery, operational outcomes.
Sees the deadline risk and escalation path. Can reassign within permission; cannot authorize.
COMPLIANCE LEADER
Policies, obligations, conflicts, exceptions, evidence, review dates, exports.
Sees the SoD conflict and the recurring bank-change exception. Can propose configuration change; cannot approve it alone.
AUDITOR / AUDIT COMMITTEE
Read-only decision records, controls, exceptions, evidence packages, integrity, and reports.
Full read access to decisions and evidence. Export excludes one restricted source and says so. No operational actions available.
INTEGRATION SERVICE IDENTITY
System-to-system actions within declared scopes, attributable and logged.
svc-bank-02 may initiate one payment instruction against the authorized version. It holds no decision rights.
Why can or can't I do this?
Every unavailable control states the rule, the missing condition, and the route to resolve it — for example: "Approve is unavailable: EVD-AP-003 requires a call-back verification record for creditor-account changes. Request evidence, or return for correction."
Role selection changes presentation and permitted actions only, never the underlying facts. No personalization is inferred without consent.
Carry governed context across systems and events
Ten identifiers travel with the action. If context, identity, state, or attribution is lost at a system boundary, the governance model is lost with it.
Apply the lifecycle within approved deployment and data boundaries
Nine lifecycle data classes, each with its own residency, retention, and access treatment. Unavailable options stay visible with a reason.
Regional hosting
Lifecycle processing and storage in a selected region.
Dedicated private cloud
Isolated tenancy with enhanced operational controls.
Enterprise single-tenant
Dedicated workload and data infrastructure.
Sovereign deployment
Region-restricted operations, administration, and support.
On-premise deployment
Customer-operated infrastructure within their own boundary.
Key control options
Platform-managed, BYOK, HYOK, or customer-controlled keys.
| Lifecycle Data Class | Region & Tenancy | Retention | Administrative Access | Export Restriction |
|---|---|---|---|---|
| Source content | Selected region · tenant-isolated | Per retention class | None by default; break-glass audited | Permission and scope controlled |
| Action metadata | Selected region | Life of the action + retention class | Scoped support access with approval | Standard export |
| Policy & control data | Selected region | Versioned indefinitely | Control owners only | Control summary export |
| Identity & authority data | Selected region · encrypted | Per identity policy | Administration role only | RESTRICTED |
| Evidence | Selected region · integrity chained | Retention class · legal hold | Evidence custodian; no silent deletion | Evidence package with receipt |
| AI inputs & outputs | Selected region · classification-gated | Configurable AI log retention | Logged; no training on customer data by default | AI event export |
| Event logs | Selected region | Configurable | Platform operations, scoped | Event log export |
| Analytics | Selected region · aggregated | Configurable | Role-aware views | No individual productivity export |
| Exports | Generated in region | Export receipt retained | Requester scope recorded | Scope, purpose, and exclusions recorded |
Purpose limitation and least privilege
A role does not see a lifecycle data class because it can see the action. Workforce data stays inside workforce purposes; commercial data stays inside commercial purposes.
No surveillance framing
The platform measures actions, controls, and evidence — not individuals. There is no productivity score, behavior metric, or hidden monitoring anywhere in the lifecycle.
Test the governance model before authorizing production actions
Shadow Mode runs the whole lifecycle against real or representative signals and stops before execution. Differences stay visible until an authorized owner dispositions them.
Discover
Inventory systems, actions, entities, jurisdictions, policies, authority, evidence, integrations, and exception patterns.
Model
Configure organizational context, action types, controls, roles, evidence requirements, events, and boundaries.
Shadow Mode
Compare current outcomes with proposed context, controls, routes, and evidence — with no production execution.
Controlled activation
Activate selected entities, jurisdictions, modules, actions, and integrations under explicit readiness and rollback criteria.
Expand and assure
Add scope, monitor exceptions, validate evidence, review controls, and approve improvements.
Verify the lifecycle claims
Six diligence routes. Status terms distinguish verified, aligned, designed, pending, and unavailable — they are not decorative.
Security
- Identity and access management
- Zero Trust architecture
- Encryption and key management
- Application and API security
- Infrastructure security
- Vulnerability management
- Incident response
- Business continuity
Compliance
- Compliance overview
- SOC 2 readiness
- ISO 27001 alignment
- GDPR controls
- CCPA controls
- Data Processing Agreement (PDF)
- Subprocessor list
- Records retention
- Responsible AI
- Accessibility
Evidence and assurance
- Evidence architecture
- Immutable audit trails
- Policy decision logging
- Evidence manifests
- Document integrity
- Audit readiness
- Internal controls
- Segregation of duties
Data sovereignty
- Data residency
- Regional hosting
- Private / single tenant
- Sovereign / on-premise
- Key options
- Recovery
- Deployment architecture
Operational readiness
- Architecture Library
- API documentation
- Integration guide
- Migration guide
- Documentation
- System status
- Support
Professional boundary
ZoikoSuite provides infrastructure, workflow, analytics, evidence, and decision support. Qualified professionals remain responsible for final regulated decisions and use.
Map your operations to a governed action lifecycle
Review how ZoikoSuite could connect your entities, jurisdictions, functions, policies, authority, systems, evidence, and decision workflows.
Mechanism, boundaries, and adoption
Direct first sentences, then qualified detail. Every answer is in the page source.
It connects source signals, business context, policies, roles, human decisions, controlled execution, evidence, and monitoring in one governed action lifecycle.
Nine stages carry the same action identity from intake through follow-up, and each stage records what it added and who was responsible. See the nine stages