---
type: concept
title: Layer 5 — Governance & Safety
aliases:
  - governance layer
  - safety layer
  - dlp layer
  - layer 5
modified: 2026-07-08
tags:
  - architecture
  - architecture-layer
  - governance
  - dlp
  - security
  - suitecentral
---

# Layer 5 — Governance & Safety

> Governance checkpoints for policy, PII detection, outbound governance, tenant isolation, approval queues, and audit redaction.

The vertical safety rail of the [[pages/concepts/suitecentral-code-architecture|seven-layer code architecture]]. This layer does not sit "after" the others — it is invoked **inline** at the decision points in [[pages/architecture/core-application-services|Layer 3]] and [[pages/architecture/ai-intelligence|Layer 4]], before any write reaches [[pages/architecture/connector-integration-layer|Layer 6]]. It covers policy checkpoints, PII/DLP detection, outbound governance validation on every egress path, tenant isolation invariants, the approval-queue persistence surface, and audit redaction. The governing invariant: **no AI-proposed change reaches an ERP connector without traversing this layer.** This governance-first posture is the platform's core differentiator — see [[pages/concepts/oracle-comparison|Oracle NSIP vs SuiteCentral 2.0]].

## Questions this layer answers

- What prevents unsafe AI or data actions?
- Where does human approval happen?

Ask them live on the **[Code Architecture Dashboard](https://demo.kstratmdconsulting.com/code-architecture-dashboard.html)** — click the governance rail on the right side of the infographic.

## Documentation & evidence

- [Production vs demo guide](https://demo.kstratmdconsulting.com/docs/architecture/PRODUCTION-VS-DEMO-GUIDE.md) — which safety surfaces are production-enforced
- Proof card: [DLP service](https://demo.kstratmdconsulting.com/docs/review/proof-cards/dlp-service.md)
- Proof card: [Governance service](https://demo.kstratmdconsulting.com/docs/review/proof-cards/governance-service.md)
- Proof card: [Guarded write / ownership enforcement](https://demo.kstratmdconsulting.com/docs/review/proof-cards/guarded-write-ownership-enforcement.md)
- Proof card: [Sync Error Assist](https://demo.kstratmdconsulting.com/docs/review/proof-cards/sync-error-assist.md)
- Live governance evidence: [[pages/entities/compliance-dashboard|SOC 2 Compliance Dashboard]]

## Related layers

- [[pages/architecture/http-api-edge|Layer 2 — HTTP-API Edge]] — tenant isolation starts at the edge; this layer enforces it downstream
- [[pages/architecture/core-application-services|Layer 3 — Core Application Services]] — hosts the approval queue this layer's policy gates feed
- [[pages/architecture/connector-integration-layer|Layer 6 — Connector & Integration Layer]] — the boundary this layer protects

---

*Last refreshed: 2026-07-06*