GCRI · Foundry
NXS-NSF
NXS-NSF (trust, authorisation and assurance) is the trust and assurance system: policy, rights and assurance decisions that every other system checks before acting, so that authentication never stands in for authorisation.
NXS-NSF in seven parts.
- 01Platforms servedNXS-NSF serves these platforms
- 02The problem it addressesAccess decisions scattered across systems drift apart
- 03Reference practiceThe standards a design like this is read against
- 04Neighbouring systemsWhat it exchanges with the other systems
- 05RoomsThe ten rooms of NXS-NSF
- 06AccessAuthorised projects only
- 07Risk AcademyWhere NXS-NSF subjects are taught
NXS-NSF serves these platforms.
- RegistryInstitutionGCRI
- FoundryInstitutionGCRI
- Artificial Intelligence and Autonomous SystemsInstitutionGCRI
- Cybersecurity and Digital ResilienceInstitutionGCRI
- Quantum TechnologiesInstitutionGCRI
- Biotechnology and BiosecurityInstitutionGCRI
- Digital Public InfrastructureInstitutionGCRI
- Governance NexusInstitutionGRF
- AI and Digital GovernanceInstitutionGRF
- Fintech NexusInstitutionGRA
- Financial Regulation NexusInstitutionGRA
- Payments and Market InfrastructureInstitutionGRA
- Financial Cyber and Operational ResilienceInstitutionGRA
- AI and Financial Model RiskInstitutionGRA
- Financial Crime and Fraud RiskInstitutionGRA
Access decisions scattered across systems drift apart.
NXS-NSF is defined in system profile NRS-S13 of the Nexus Standards. When every application implements its own permissions, the same person can be allowed in one place and refused in another, and nobody can answer who may do what. A shared decision point with explicit grants, deny-by-default rules and an audit trail is the control.
- Explicit grants per project, role and data class.
- Deny by default; authenticated is not authorised.
- Assurance evidence attached to decisions.
The standards a design like this is read against.
| Reference | Relevance |
|---|---|
| NIST CSF 2.0 (govern function) | Cybersecurity governance |
| ISO/IEC 27001 | Access control and information security management |
| ISO/IEC 42001 | Controls for AI use |
What it exchanges with the other systems.
- Every system calls NXS-NSF before acting; NXS-NXQ (software, models and capability lifecycle) and NXS-COR (compute, nodes and runtimes) most often.
- Decisions recorded with NXS-RLS (participants, agreements and handoffs).
The ten rooms of NXS-NSF.
NXS-NSF has the eight rooms every Foundry system shares, set to its own authority, and two specialist rooms, Authority and Assurance. Each is described by the work it is designed for; the public register records NXS-NSF as declared, not deployed.
| Room | Kind | Designed to |
|---|---|---|
| Station | Shared | Operate, inspect and correct authoritative domain posture for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Mission | Shared | Coordinate bounded objective-oriented intelligence and human handoff for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Builder | Shared | Design, engineer and prepare governed changes and artefacts for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Maps | Shared | Inspect and compose spatial, temporal and world-model intelligence for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Data | Shared | Work with data, ontology, Chronotopes, graphs, scientific methods and risk for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Commons | Shared | Work with policy, law, standards, clauses, obligations and assurance for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Reports | Shared | Compute, model, synthesise and visualise governed analytical products and reproducible reports for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Knowledge | Shared | Work with institutional memory, records, citations, runbooks and learning for trust, authorisation, mandate, purpose, sovereignty, policy and assurance |
| Authority | Specialist | Make mandates, delegations, purpose constraints, jurisdiction profiles and authorisation decisions inspectable and governable |
| Assurance | Specialist | Assemble and review bounded assurance cases connecting claims, controls, evidence, findings, exceptions, remediation and reliance limits |
Authorised projects only.
Access requires an authorised project with an accountable owner, data terms and a review plan. Enquiries go to the contact form.
Where NXS-NSF subjects are taught.
Risk Academy, led by the Nexus Consortium, teaches the subjects practised in NXS-NSF in these disciplines; the Global Centre for Risk and Innovation (GCRI) links to the Academy as a partner and does not provide its courses.
- AI safety and evaluationFacultyFaculty of Technology and Digital SystemsNXS-NSF roomsAssurance
- AI assurance and auditFacultyFaculty of Technology and Digital SystemsNXS-NSF roomsAssurance
- Cybersecurity and digital resilienceFacultyFaculty of Technology and Digital SystemsNXS-NSF roomsAssurance, Authority
- Digital public infrastructure and digital identityFacultyFaculty of Technology and Digital SystemsNXS-NSF roomsAuthority
- Operational technology and cyber-physical securityFacultyFaculty of Technology and Digital SystemsNXS-NSF roomsAssurance
- Biotechnology, biosecurity and neurotechnologyFacultyFaculty of Health and SocietyNXS-NSF roomsAuthority
- Financial regulation and supervisionFacultyFaculty of Finance and EconomicsNXS-NSF roomsCommons
- Financial crime and fraudFacultyFaculty of Finance and EconomicsNXS-NSF roomsAuthority
- Operational resilience and ICT risk in financeFacultyFaculty of Finance and EconomicsNXS-NSF roomsAssurance
- Payments, market infrastructure and fintechFacultyFaculty of Finance and EconomicsNXS-NSF roomsAssurance
- Risk governance and institutionsFacultyFaculty of Governance, Policy and International AffairsNXS-NSF roomsAuthority
- Innovation and frontier technology governanceFacultyFaculty of Governance, Policy and International AffairsNXS-NSF roomsCommons
- AI and digital governanceFacultyFaculty of Governance, Policy and International AffairsNXS-NSF roomsAuthority, Assurance
- Technology security: dual-use, export controls and compute governanceFacultyFaculty of Governance, Policy and International AffairsNXS-NSF roomsAuthority
- Compliance and regulatory changeFacultyFaculty of Governance, Policy and International AffairsNXS-NSF roomsCommons
- Enterprise risk management and risk frameworksFacultyFaculty of Risk Science and MethodsNXS-NSF roomsAssurance
- Assurance, internal control and risk cultureFacultyFaculty of Risk Science and MethodsNXS-NSF roomsAssurance, Commons
- Risk data governance, provenance and licensingFacultyFaculty of Risk Science and MethodsNXS-NSF roomsAuthority
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Is the system available now?
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.