The enterprise defines authority.ServiceNow provides governance and context.Karvin makes the operating model deployable.VORTIQ-X evaluates protected actions at runtime.
What is VORTIQ-X?
VORTIQ-X is an independent runtime AI Action Authority plane. It decides, at the moment an AI action is requested, whether that action is permitted — allowing, holding, transforming or denying it before it executes.
What does ServiceNow do?
ServiceNow is the governance system of record: AI inventory, risk classification, ownership, policy, lifecycle workflow and evidence. It provides the context that authority decisions depend on.
What does VORTIQ-X do?
VORTIQ-X provides independent runtime authority. It checks each protected action against defined boundaries and decides whether it may proceed, before the action becomes an operational consequence.
What does Karvin implement?
Karvin designs and implements the enterprise architecture connecting ServiceNow governance and workflow with VORTIQ-X runtime authority, so decisions and evidence flow back into the ServiceNow governance record.
This is not a limitation of ServiceNow. ServiceNow provides strong AI governance capabilities including AI Control Tower. VORTIQ-X adds an independent runtime authority layer for whether a specific action may execute — a complementary capability that Karvin connects to ServiceNow governance.
Three layers. One architecture.
ServiceNow
Governance system of record and workflow platform.
AI inventory, risk, controls, ownership, lifecycle and evidence.
VORTIQ-X
Independent action authority plane.
Decides whether an AI may act, before the action becomes a consequence.
Karvin
Implementation and integration partner.
Designs and implements the architecture connecting governance and authority.
From enterprise authority to evidenced action.
The enterprise defines authority. ServiceNow provides governance and context. Karvin implements the operating model. VORTIQ-X evaluates protected actions at runtime.
Policy, delegation, ownership, risk appetite and regulatory requirements. The enterprise, not the AI, decides who may act and under what conditions.
AI Control Tower, IRM / GRC, ownership, risk, policy, workflow, approvals and enterprise context. The governance system of record.
Boundaries defined by risk, data sensitivity, system, user, financial limits, approval thresholds and context. Karvin translates organisational rules into implementable authority requirements.
An independent runtime AI Action Authority layer. It determines whether a protected action is authorised under the enterprise-defined authority model before that action becomes an operational consequence.
Only the authorised action executes in the target system. The enterprise system acts according to the implemented authority model.
Every decision and action is recorded and returned to enterprise governance and evidence systems where appropriate, for audit and regulatory reporting.
Karvin is the specialist implementation and advisory layer. Karvin is not a runtime software layer. Karvin designs and implements the operating model connecting enterprise governance, ServiceNow and runtime authority.
Where authority boundaries matter most.
The following are illustrative enterprise examples, not existing customer deployments.
Procurement AI Agent
Actions: Raise purchase orders, approve suppliers, modify contracts.
Boundaries: Spend limits, supplier risk tier, approval routing.
Customer Service Agent
Actions: Issue refunds, update account records, escalate cases.
Boundaries: Refund value caps, data access scope, human escalation points.
Financial Approval Agent
Actions: Approve payments, release invoices, adjust ledgers.
Boundaries: Financial limits, segregation of duties, regulatory checks.
Infrastructure Remediation Agent
Actions: Restart services, modify configurations, close incidents.
Boundaries: Change scope, environment limits, rollback authority.
Third-Party Risk Agent
Actions: Trigger assessments, request evidence, update risk scores.
Boundaries: Assessment scope, data handling, escalation to analysts.
HR Service Agent
Actions: Update employee records, process leave, action case tickets.
Boundaries: Data sensitivity, role-based access, policy compliance.
Example only. These are illustrative enterprise AI agent scenarios, not named customer deployments.
Let AI do the work. You keep the final say.
Your AI proposes the work. VORTIQ-X checks whether it has permission to act. It connects your rules to your systems, grants permission for the specific action and records the outcome. Your AI does the work. You hold the authority.
An AI proposes a £2,000,000 supplier payment. Here is the control path.
The AI asks
“Pay £2,000,000 to Acme Ltd against invoice 4471.” The full request, in writing, ready for your rules to judge.
Your rules decide
Approved supplier. Within limit. Required signatures in place. Your rules permit this exact payment or hold it for review.
The payment goes through
The connected payment system uses permission for that amount and recipient, once. That permission cannot authorise a second payment.
Proof comes back
The connected system returns the outcome for your records. If confirmation is missing, the result stays unresolved while it is checked.
Six things that stay in your hands.
Who is in charge
Your rules, your approvals, your keys. Every permission is issued in your name.
Where it runs
On your own equipment, in the UK, right down to a fully disconnected site.
What information leaves
You choose what the AI sees, what it passes on, and where in the world it goes.
What it may do
One permission covers one action, exactly as your rules describe it, and then retires.
Which AI is used
You approve the exact model and version. New releases arrive through your approval process.
How it behaves under pressure
Permissions tighten during a disruption, and you decide the moment work resumes.
What the tests showed.
Results from three recorded tests. Figures describe the recorded test configurations; these are separate from HPE validation and SUSE certification.
The tested permission check took 20.52 ms, compared with 132.12 ms for the route it was measured against, across 20,000 cases.
The tested request used 624 bytes instead of 5,056. All 16 legitimate actions completed in that evaluation.
All five tested sovereignty checks passed, including detection of the tested cross-border violation.
Everything you keep
Who this is for
Anywhere getting the action right the first time is worth real money.
Appendix · The Servers It Runs On
| To Trial · One Server | For Production · Three Servers | |
|---|---|---|
| Server | 1 × 1U or 2U enterprise server | 3 independent 1U or 2U servers |
| Processor | 1 socket, 16 cores | 1 socket, 24 to 32 cores per server |
| Memory | 64 GB ECC | 128 GB ECC per server |
| Storage | 2 × 960 GB boot, 2 × 1.92 TB NVMe | 2 × 960 GB boot, 4 × 3.84 TB NVMe |
| Networking | 4 × 10/25GbE | 4 to 6 × 25GbE on separate adapters |
| GPU / AI Chip | Optional | NVIDIA, where you host models locally |
Ordinary rack power and cooling. Equipment for running AI models locally is sized alongside it, and the final specification is agreed with you. Preferred infrastructure: HPE servers · SUSE Linux.