A demo reference for the commvita Policy-to-Process (P2P) engine — how the Scheme of Reservation & Delegation and Standing Financial Instructions become live authority data, how a source policy is generalised into a bindable process, how every step is enforced as hard · soft · advisory with structured escalation onto one immutable, hash-chained audit, and how the same policy set is safely composed for a second jurisdiction.
A policy is not a PDF that sits in a folder — in P2P it is decomposed into layers that each do one job. Authority says who can do what up to what limit; the Policy Bank holds the generalised process; the Process Engine enforces it; escalation and the WORM audit carry what actually happened; and composition safely ports the set to another jurisdiction.
The Scheme of Reservation & Delegation (SoRD) and Standing Financial Instructions (SFI) are held as versioned, effective-dated rows: role × decision × delegated limit × instrument. This is the single source of authority every process step is checked against — not prose buried in a policy document.
| Role | Decision | Authority limit | Instrument |
|---|---|---|---|
| Budget Holder | Non-pay procurement (quotes) | £0 – £25k | SFI |
| Budget Holder | Non-pay procurement (single tender) | requires waiver | SFI |
| Service Manager | Non-pay procurement | £25k – £50k | SFI |
| Director | Non-pay procurement | £50k – £250k | SFI |
| Chief Executive | Non-pay procurement | £250k – £1m | SoRD |
| Board / Committee | Non-pay procurement | > £1m | SoRD |
Served live from GET /p2p/authority (model P2PAuthorityRow). Because rows are effective-dated, a threshold change is a new version — the old limit is never overwritten.
Source policies are ingested and generalised into de-identified process definitions with bindable slots (the local thresholds, roles and routes) plus provenance. Each policy is clickable and drills through to its definition and its underlying process & escalation workflow.
Procurement value tested against the SFI thresholds above. The fully-encoded, API-backed process (below).
Care Act 2014 s42 concern → threshold test → MASH → enquiry decision, involving the person and advocate.
Single-tender waiver, study-leave funding and a proportionate PSIRF incident response — each with its own steps & ladder.
Served live from GET /p2p/policy-bank (models P2PPolicyDef, P2PProcessStep). Clicking a policy opens its definition (domain, bindable slots, provenance, status) with the process & escalation workflow underneath — no dead rows. Licensing is checked per source before any generalised definition is redistributed.
A step is not simply "done / not done". Each carries an enforcement mode, and steps are promoted advisory → soft → hard as they are proven safe to enforce. This is the worked example for PB-01 · non-pay procurement vs SFI thresholds, end to end.
Requester · guided; free to proceed
Budget Holder · warn if no funds; override with reason
System · blocks if above the delegated limit — must escalate
Budget Holder · blocks award without the required quotes/waiver
Approver · routed to the role with authority for the value
Finance · PO number recorded to audit
Finance · reconcile PO / GRN / invoice
When a hard step fails, authority is not overridden — it is escalated up the ladder until a role with the authority to decide assumes it. Every decision, override and escalation is appended to a SHA-256 hash-chained WORM audit (prev_hash → row_hash), re-verified server-side on every read — there is no update or delete endpoint.
Worked example — REQ-4471. A £38,200 laptop order exceeds the Budget Holder's £25k limit: the system blocks, escalates, and authority is assumed one rung up.
| # | Actor | Action | Mode |
|---|---|---|---|
| 1 | j.reeves (Requester) | Requisition REQ-4471 raised · £38,200 · IT laptops | advisory |
| 2 | s.patel (Budget Holder) | Budget confirmed (code CC-2231) | soft |
| 3 | system | SFI check: £38,200 exceeds Budget Holder £25k — BLOCKED, escalated | hard |
| 4 | a.morris (Service Manager) | Assumed authority (£25k–£50k band) · 3 quotes attached | hard |
| 5 | a.morris (Service Manager) | Approved · PO-88123 raised | hard |
Served live from GET /p2p/audit (model P2PAuditEvent). The response carries a chain_valid flag; if a single row is altered the chain fails and a tamper-evidence banner fires. This is the evidence stream for BAF / risk register / CQC.
A hard step becomes a gate — an approval task assigned to a role or a named individual, with an SLA that auto-escalates on timeout. This is the runtime of the two sections above: a BPM approval engine (user task + candidate assignee + timer-boundary escalation) on the authority spine.
Add ordered gates to a policy — each with an authoriser (role or named individual), an SLA, an escalation target and an optional e-signature. POST /p2p/gates
Raising a policy creates one approval task per gate; only the active gate's SLA clock runs. Decide with approve / reject / request-info. /p2p/instances · /p2p/tasks/{id}/decide
An overdue gate re-routes to its escalation target, notifies the assignee, and writes the timeout to the immutable audit — evaluated lazily on read and via a swept /p2p/tasks/sweep. Idempotent (escalates once).
A high-assurance gate requires a completed commvita Sign ceremony (external_ref p2p-task:{id}, 428 otherwise) — eIDAS-grade evidence bound to the decision.
One click composes a plain-English process overview and policy summary — deterministic by default (works with no key / in CI), enhanced by the central AI provider when configured. POST /p2p/policy/{ref}/summarise
Models P2PGate · P2PProcessInstance · P2PApprovalTask · P2PPolicyDoc. Surfaced in the Gated Approvals tab (a live board with green / amber / overdue SLA badges) and the policy drill-through dialog (gate builder + commvita overview).
The same generalised process can be deployed to a second jurisdiction by binding its slots to local values. Conflict / gap detection blocks unbound deployment, and binding is a governance act, not a config toggle — it requires a recorded local mapping note and a completed commvita Sign ceremony (else the API returns 428), written straight to the WORM audit.
| Requirement (example: a Gulf cluster) | Bound? | Local mapping |
|---|---|---|
| SFI thresholds bound to local delegated limits | ✓ bound | cluster values mapped |
| SoRD roles mapped to local job titles | ✓ bound | CEO → Cluster Director General |
| Procurement route (regulations) selected | ✓ bound | local procurement law bound |
| Safeguarding referral authority mapped | GAP | no local S42-equivalent bound |
| Accountable local sign-off recorded | GAP | sign-off required before deploy |
Served live from GET /p2p/compositions and the signature-backed POST /p2p/compositions/{id}/bind (model P2PComposition, linked to commvita Sign via p2p-comp:{id}). While any requirement is unbound, deployment is blocked — a jurisdiction is never quietly shipped with a governance gap.
| Layer | Tab | API | Model / logic | Standard | Status |
|---|---|---|---|---|---|
| Authority — who/what/limit | Authority Matrix | /p2p/authority | P2PAuthorityRow — versioned, effective-dated | NHS SoRD · SFI | Live |
| Policy Bank — generalised process | Policy Bank | /p2p/policy-bank · /p2p/process-steps | P2PPolicyDef · P2PProcessStep · clickable drill-through | Procurement Act 2023 · Care Act s42 · PSIRF | Live (PB-02–05 workflows Demonstrated) |
| Process Engine — enforcement gradient | Process Engine | /p2p/process-steps?ref=PB-01 | hard / soft / advisory per step; break-glass on clinical | SoRD · SFI · Non-SaMD | Demonstrated (PB-01 steps API-served) |
| Escalation + WORM audit | Escalation & Audit | GET/POST /p2p/audit | P2PAuditEvent — SHA-256 prev_hash→row_hash, append-only, re-verified on read | BAF · CQC SAF · GDPR Art.5(1)(f) | Live (example events seeded) |
| Gated approvals — runtime engine | Gated Approvals | /p2p/gates · /p2p/tasks/{id}/decide · .../sweep | P2PGate · P2PApprovalTask · SLA auto-escalation · commvita Sign · AI summary | NHS SoRD · SFI · CQC SAF · eIDAS AdES | Live |
| Jurisdiction Composition | Jurisdiction Composition | /p2p/compositions · .../bind | P2PComposition · commvita Sign p2p-comp:{id} · 428 gate | Jurisdiction Profile PRD §4.6 · eIDAS AdES | Live (example bindings seeded) |