A technology supplier that states its limits.

+Kerah may

• Recommend, rank, validate, reconcile and route, and show the evidence behind each
• Enforce an approval limit, a permission and a segregation of duties in software
• Record who decided, when, on what evidence and under which version of the policy

×Kerah must not

• Take an act that commits the organization or materially affects a person
• Change an approval limit, a permission or a delegation without its authorised holder
• Present a recommendation as though the system held the authority to act on it

+Kerah may

• Design, build, integrate and evolve systems under Information Technology Consultancy and Computer Systems and Software Designing
• Deploy into the client's own cloud tenancy, under the client's own accounts, subscriptions and keys
• Hand over runbooks, architecture documentation and a tested exit as delivery output

×Kerah must not

• Host, resell or operate infrastructure, capacity or third-party licences
• Act as a managed infrastructure provider, a security operations centre or a data-processing service
• Act as an organization's data protection officer or compliance function
• Certify, audit or attest to any organization's compliance

+Kerah may

• Integrate approved banks, gateways and finance systems
• Reconcile transaction references and produce the finance evidence trail
• Build budget, commitment, restriction and purpose accounting

×Kerah must not

• Operate a wallet, payment service, exchange, escrow or client-money account
• Hold, route or disburse a client's funds
• Release a payment without the configured human authority

+Kerah may

• Check completeness, detect duplicates, rank urgency and prepare a recommendation
• Surface the evidence behind a recommendation, including what is missing
• Apply the organization's own published criteria consistently, and show which version was applied
• Record the decision, the decider and the reasoning

×Kerah must not

• Decide a person's application, entitlement, claim, credit, admission or employment
• Score or rank a person on a characteristic the organization has no lawful basis to use
• Deploy an automated decision about a person without a review and appeal route

+Kerah may

• Process personal data on the client's documented instructions under a data processing agreement
• Build purpose limitation, retention and deletion into the system rather than into a policy nobody executes
• Support access, correction, deletion and objection requests

×Kerah must not

• Reuse client, customer, employee or beneficiary data for Kerah's own purposes
• Use client data to train a general-purpose model
• Move personal data outside the agreed environment

+Kerah may

• Build secure case workflows and integrations with approved providers
• Treat health, biometric, children's, financial and criminal-record data as a separate data class with its own access model

×Kerah must not

• Move special-category data outside the approved environment
• Expose special-category data to a general-purpose AI service
• Grant access to it through a general operational role

+Kerah may

• Hold access granted for a named purpose and a defined period, under the client's own identity provider
• Work in an environment separated from production, with data reduced or masked for testing
• Design break-glass access so that its use is recorded and reviewable

×Kerah must not

• Hold standing production access, or any access the client cannot see and revoke
• Copy production data into a development environment, a personal device or a messaging tool
• Use privileged access for anything other than the task it was granted for

+Kerah may

• Build an audit trail that records what happened, who caused it and when
• Execute retention, archiving and deletion in software rather than in a policy nobody runs
• Produce the extract an auditor, a regulator or a disclosure request asks for

×Kerah must not

• Alter, delete or backdate a record outside the correction process agreed with the client
• Build an audit trail that an operational role can edit
• Retain a client's records beyond the retention period or the exit point agreed for them

+Kerah may

• Integrate screening services and present alerts with their evidence
• Build counterparty-risk workflows and preserve the audit trail
• Restrict access to alert data to the people entitled to see it

×Kerah must not

• Replace the client's compliance officer
• Assert that a person or counterparty is guilty of anything
• Auto-close or auto-escalate an alert without a recorded human disposition

+Kerah may

• Draft reports, returns and narratives from approved evidence
• Build the approval workflow that stands between a draft and its release
• Reconcile a submission against the records it is drawn from, and show any difference

×Kerah must not

• Publish the identity or image of a customer, an employee or a beneficiary
• Release a performance or impact claim automatically
• Sign, submit or file anything to a regulator, an authority or the public on a client's behalf
• Publish anything about a client's work under Kerah's own identity

+Kerah may

• Build assistants and agents scoped to one task, one permitted data set and one set of tools
• Let an agent act only through defined tools, within the permissions of the person it runs for, with every effect recorded
• Evaluate against real cases before deployment, including the malformed and multilingual ones, and define the fallback when a model is unavailable

×Kerah must not

• Deploy an agent that grants itself access, spends money or contacts a third party unattended
• Put a consequential act behind a model output rather than behind a person
• Send client data to a general-purpose model outside the agreed environment, or use it to train one

+Kerah may

• Build permit workflows, campaign controls, donor records and reporting integrations
• Link every published campaign to its approval record and its licensed collection channel
• Produce the reporting a regulator or an auditor asks for

×Kerah must not

• Solicit, receive or hold donations in its own name
• Publish a fundraising campaign under Kerah's identity
• Present itself as a charity, a fundraiser or a collection channel

+Kerah may

• Encode approved rules as versioned, auditable policy
• Preserve the evidence a ruling was applied to
• Route exceptions to the authorised body

×Kerah must not

• Issue a religious ruling
• Decide Sharia eligibility independently
• Change an encoded rule without the authorised body's approval

+Kerah may

• Build to the authority's procurement, accessibility, records and bilingual requirements
• Produce architecture, data-flow, access-model and exit documentation as delivery output
• Support a disclosure or records request from the source records

×Kerah must not

• Represent an authority, speak for it, or act under its official capacity
• Handle material an authority has classified or marked restricted outside the environment and clearances agreed for it
• Retain a public record beyond the agreed retention or the exit point
• Use an authority's data or content for any purpose other than the engagement

+Kerah may

• Respond to a tender, and answer a technical clarification on the record
• Provide indicative architecture or an estimate where an authority asks every supplier the same question
• Declare a conflict, an incumbency or a prior involvement before a competition opens

×Kerah must not

• Write or shape a specification it intends to bid against without declaring it
• Offer, promise or provide any inducement to a person involved in an award
• Use non-public information from one engagement to gain an advantage in another