Steward-GRC™
Rules kept.Voices heard™.
Steward-GRC keeps an organisation's policies and procedures in one place, takes them through multi-stage approval workflows, tracks who has read and acknowledged them, and backs every change with a hash-chained, independently verifiable audit trail.
$ helm dependency build .
$ helm install steward . -f values.yaml --namespace steward --create-namespaceWhat it is
Steward keeps your organisation's rules in one place and gives everyone a safe way to speak up.
Instead of hunting through email or shared drives, you come here to find, read and confirm the one that matters to you.
Policy & procedure
A policy is a written rule: it tells people in your organisation how to do something the right way. A procedure is a written set of steps: it walks through how to actually carry a policy out.
Workflow
An ordered set of approval stages a draft moves through before it is published.
Acknowledgement
A user's confirmation that they have read a document. The record stands while the user keeps Acknowledge access to that document's category; it is cleared if they lose it.
Access model
Access is controlled per category, so the same person may have different rights in different parts of the category tree.
How it runs
Steward is a self-hosted platform: one umbrella Helm chart composing every service, each with its own high-availability Postgres instance.
The chart lives in steward-release, the first-class install path for anyone who already runs Kubernetes and wants to bring their own.
The appliance is the other path: a separate, single-node closed-shell OS image for anyone who doesn't.
Default values install no cluster-scoped object: no CRDs, ClusterRoles, webhooks or ClusterIssuers.
Coming later
The optional Compliance reporting and Ethics modules
This guide doesn't yet cover the optional Compliance reporting and Ethics modules; a later edition will.
Compliance reporting
A module where anyone in the organisation can report a privacy or health-information compliance concern, anonymously or with their name, and a privacy officer works the case to a close.
Ethics
Ethics has two parts: reporting, which works like Compliance reporting (anyone can raise a concern, anonymously or with their name, and an ethics officer works the case in a separate queue), and annual attestations, where everyone reads and confirms a set of documents, makes required disclosures, and signs.