The path an act takes
- 01
Answers name the records behind them.
- 02
An action carries a permit before it runs.
- 03
Governed acts write durable audit records.
01What it is
Where an organization keeps what it knows, and who may decide with it.
An organization works inside its own workspace. A permitted person brings in text — pasted, a .txt or .md file, or a text-bearing PDF — and it becomes a knowledge record attributed to its source and to the person who added it.
Anyone permitted can then ask a question and receive an answer drawn from those records, with the records shown beside it. When the organization holds nothing on the subject, the answer says so rather than composing one. Authority to decide is read from a recorded act, never inferred from a job title.
Anatomy of a governed record
- The thing decided about.
- The recorded act that made this decider able to decide.
- Who performed it — a person, never a system role name.
- The organization it belongs to, checked on every read.
- When it happened, written once.
- Whether the record stands, was superseded, or was withdrawn — never inferred.
Field names, not sample data. Hebun shows no record it does not hold.
02The governed path
A chatbot answers. Hebun records.
One path runs from what an organization knows to what it permitted and what was written down afterwards. The stages are not equally wide, and each one below states where it stops.
Knowledge
Text a permitted person brought in becomes a record, attributed and versioned.
Held as a provisional draft until a governing act says otherwise.
Evidence
The records that bear on one question are selected and shown with the answer.
Selection is lexical. There is no semantic matching and no browse surface.
Decision
A named authority decides, and the decision is written down.
Governed decisions today cover one subject: an organization's knowledge records.
Permit
Authorization is issued as its own record before anything runs.
A permit is spent by a specific act; it is not a standing permission.
Action
An act is attempted only against a permit that already exists.
Acts inside Hebun. No external system is written to from here.
Audit record
The act is recorded durably, with its actor and its authority.
Governed acts write durable audit records. Not every surface in the product is one.
03What works today
Every capability is published with the limit that goes with it.
Anything absent from this table is absent from the product.
| Capability | State | Limit |
|---|---|---|
| Tenant workspace | Membership is by invitation from the organization. There is no self-serve sign-up, and every read is scoped to the organization the request belongs to. | |
| Knowledge ingestion | Pasted text, a UTF-8 .txt or .md file, or a text-bearing PDF. No OCR, no connector, no scheduled import, and the uploaded bytes are not retained. | |
| Evidence-backed answers | Evidence is selected for a question being answered. There is no search surface, no semantic matching and no embeddings. | |
| Coverage view | Counted over the knowledge your organization has written down, by area — not over your other systems. | |
| Governed action authorization | Request, decision, permit and consumption are four separate recorded steps. Nothing acts on its own initiative. | |
| Google connection | Bound to a Google account. What Hebun may do is derived from the scope that account actually granted; Workspace-wide administrative identity is not requested. | |
| Drive metadata read | File names, types and timestamps under drive.metadata.readonly. This capability reads no file content, nothing in Drive is written, and nothing read from Drive is persisted as knowledge. |
- Capability
- Tenant workspace
- State
- Limit
- Membership is by invitation from the organization. There is no self-serve sign-up, and every read is scoped to the organization the request belongs to.
- Capability
- Knowledge ingestion
- State
- Limit
- Pasted text, a UTF-8 .txt or .md file, or a text-bearing PDF. No OCR, no connector, no scheduled import, and the uploaded bytes are not retained.
- Capability
- Evidence-backed answers
- State
- Limit
- Evidence is selected for a question being answered. There is no search surface, no semantic matching and no embeddings.
- Capability
- Coverage view
- State
- Limit
- Counted over the knowledge your organization has written down, by area — not over your other systems.
- Capability
- Governed action authorization
- State
- Limit
- Request, decision, permit and consumption are four separate recorded steps. Nothing acts on its own initiative.
- Capability
- Google connection
- State
- Limit
- Bound to a Google account. What Hebun may do is derived from the scope that account actually granted; Workspace-wide administrative identity is not requested.
- Capability
- Drive metadata read
- State
- Limit
- File names, types and timestamps under drive.metadata.readonly. This capability reads no file content, nothing in Drive is written, and nothing read from Drive is persisted as knowledge.
04Integrations
An organization can connect a real Google account.
An organization can connect a real Google account. What Hebun may then do is derived from the scope that account actually granted, read back in Google’s own spelling and checked before anything is spent — a short grant is reported as short, not as an error.
Any other integration is listed here the same way, with the access it needs written next to it.
granted
Drive metadata read, under drive.metadata.readonly — file names, types and timestamps.
not granted
No Drive file-content read. A file cannot be opened or downloaded.
not built
No Drive write. Nothing in Drive is created or changed.
not persisted
Nothing read from Drive becomes knowledge. There is no Drive-to-Knowledge path.
05Security and governance
Named mechanisms, not adjectives.
- passwords
- Stored only as scrypt hashes. There is no recoverable copy anywhere in the system.
- sessions
- Session references are stored as HMAC digests, never as the value a browser carries.
- credentials
- Provider credentials are encrypted with AES-256-GCM and bound to the row they belong to, so a credential moved between organizations fails to decrypt rather than quietly working.
- tenant boundary
- Every read is scoped to the organization the request belongs to, resolved per request rather than trusted from sign-in.
- secret handling
- A stored credential is never rendered to any screen and never leaves the server seam that spends it.
- authorization
- An action is requested, decided and permitted before it runs. Authority is read from a recorded act, never inferred from a role name.
- audit
- Governed acts write durable audit records, carrying the actor and the authority behind them.
Hebun holds no compliance certification and claims none.
Access
Hebun is not open for self-serve sign-up.
Organizations join by invitation. Tell us who you are and what your organization needs to govern.