Concepts

Warden's model rests on a few deliberate design positions. Knowing them explains why the product behaves the way it does.

Approval at the field level, resuming at the change

Native workflow approves documents. Warden approves changes. The difference shows the moment a record is edited after approvals have started: document-level workflow restarts from the top and discards every sign-off already collected, while Warden's field-level approval resumes at the change. Only the fields that actually changed need new approval.

This is not a convenience feature. Controls that restart get bypassed, batched around, or turned off, because they punish normal work. Controls that resume get kept. Resumable approval is what makes strict governance sustainable in a system people use all day.

Governing what workflow cannot reach

Some Finance & Operations documents and order types simply cannot be put under native workflow. Warden extends change control to them, so the scope of your controls is decided by your control framework, not by which document types the platform happened to cover.

Enforcement in the transaction

A control enforced by a nightly report is a control you find out about tomorrow. Warden enforces in the transaction: an unapproved change does not take effect, rather than taking effect and being flagged later. This distinction, prevention rather than detection, is what lets you assert to an auditor that the control cannot be bypassed, instead of asserting that bypasses would probably be noticed.

Reads are audited, not just writes

The standard database log records writes only, table by table, and no reads at all. Warden's activity trail covers both: every change and every view, by named user, across the tables you place in scope. This is the record that answers the questions that actually get asked in audits, data-subject requests, and investigations: who pulled the payroll table, who opened that customer's record, who looked at pricing before the leak.

Scope is yours to choose. Auditing reads on every table would be noise; auditing them on the sensitive few is evidence.

Posted means immutable

Once a transaction is posted, Warden can lock it against edits outright. Combined with the activity trail, this gives posted financial records the property regulators and auditors actually want: not "changes are logged" but "changes are impossible, and here is the record proving nothing touched it".

Tamper-evident by construction

An audit trail that can be silently altered is worth little. Warden's trail is tamper-evident: modifications to the record itself are detectable. When you export evidence for an auditor, you can stand behind it.