Four eyes, a reason and an audit trail: what a governed record brings

• Correcting a parcel geometry: the corrected boundary changes the area and the evidence behind a file, so a second person approves it.
• Recording a reimbursement paid from public funds: the amount and its justification are approved, then kept.
• Publishing a result to buyers: the release is approved and dated, and what was known at that moment stays readable.

The person who creates or changes a record cannot approve it. The checker sees the change, the evidence attached (links, references, uploaded documents, attestations) and votes. A rejection must carry a comment, so the maker knows what to fix; an approval may carry one.

Sensitive steps ask for a reason chosen from a catalogue, in the user's language. An “other” reason is always possible, with its detail attached as evidence in the same step. The wording stays factual: a doubt is recorded as a suspected error or a suspected non-compliant use, never as an accusation.

When a deadline cannot wait or reviewers are unavailable, an emergency access exists. It is limited to a few predefined reasons and is always reviewed after the fact, so the exception does not become a shortcut.

• Every step is chained to the previous one; a daily check verifies the chain, and a record whose chain is broken is quarantined.
• When personal data must be erased, the content of a record is erased without breaking the chain.
• A record type can be switched to read-only without stopping the service.
• The roles that manage access or emergency access require two-factor authentication.

• Phoeniks release notes, V1: https://phoeniks.org/en/release-notes/v1