> For the complete documentation index, see [llms.txt](https://docs.therisk.global/organization/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.therisk.global/organization/operations/frameworks/nexus-leadership-system-nls/xviii.-zero-trust.md). # XVIII. Zero Trust Understand Zero-Trust Leadership in NLS, including identity, access control, role governance, institutional responsibility, evidence verification, and human review. **Where this fits:** all six sectors · [Nexus Universe](/organization/programme/universe.md), [Risk Academy](/organization/programme/academy.md) · The Global Risks Forum (GRF), with GCRI Canada as Consortium Secretariat · the programme year (quarterly NLC alignment; the Year-One Gateway) · systems [NXS-HUB](/organization/systems/nxs-hub.md), [NXS-RLS](/organization/systems/nxs-rls.md), [NXS-NSF](/organization/systems/nxs-nsf.md) · framework page (NLS). **In brief.** We establish Zero-Trust Leadership as a foundational doctrine of NLS because a federated leadership system inevitably contains people who are senior, influential, highly connected, active across several institutions and capable of operating through multiple Nexus environments simultaneously. This page belongs to the Nexus Leadership System (NLS), read as the leadership method of the operating model: it describes how leaders selected in a personal capacity contribute through the National Leadership Council (NLC), alongside the Helix councils of the National Nexus Consortium (NNC) and the National Working Groups (NWG). Selection precedes payment. Council standing does not buy office, employment, a Board seat or restricted data, and an employer does not own a personal seat; no council decides for a public authority. The method aligns with international practice ([ISO 2018](https://www.iso.org/standard/65694.html); [OECD 2014](https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0405)). {% hint style="info" %} **Read with the current model (21 October 2026).** The "Leadership Councils" of this framework correspond, at national level, to the [National Leadership Council (NLC)](/organization/governance-in-operation/nlc.md), the leadership pillar of [National Nexus](/organization/governance-in-operation/national-nexus.md); the regional and global leadership councils are the councils of the GRF council architecture, in formation ([Councils](/organization/governance-in-operation/councils.md)). Institutions take part through the six Helix councils of the [NNC](/organization/governance-in-operation/nnc.md) (SPC, IOC, ARC, CMC, CIC and the FIR pathway); expert work runs through [NWG](/organization/governance-in-operation/nwg.md) assignments, with the six CERTs under them. Earlier labels are mapped in running text: Competence Cells are the atomic units of the NWG fabric, formed at institution, community or agency level; a Competence Cell can serve as a CERT, Investors Councils are the Financial Institutions and Regulators (FIR) pathway, `Nexus Grid` is the `Nexus Network` and [NXS-NET](/organization/systems/nxs-net.md), Protocol Authority is NXS-NSF ([Reference](/organization/reference.md)). Leadership work follows [the programme year](/organization/programme/the-programme-year.md): mandate at G0, quarterly alignment, Action Week, renewal at G7. {% endhint %} ## 18. ZERO-TRUST LEADERSHIP ### 18.1 The Zero-Trust Leadership Principle #### 18.1.1 Zero trust means no consequential leadership state is assumed merely because another state exists We establish **Zero-Trust Leadership** as a foundational doctrine of NLS because a federated leadership system inevitably contains people who are senior, influential, highly connected, active across several institutions and capable of operating through multiple Nexus environments simultaneously. Without an explicit discipline, proximity begins to create assumptions. A Council Member may be treated as though they represent the Council in every setting. A Chair may be assumed to possess wider decision authority. A Board nominee may be spoken of as though they were already appointed. A professional assignment may be confused with Council responsibility. Access to information may be interpreted as permission to use it for another purpose. NLS is designed to prevent these silent conversions. Zero trust in this context does not mean distrust of leaders. It means that significant institutional states should be established explicitly rather than inferred casually from another fact. The underlying doctrine is: > **Identity ≠ authority ≠ capability ≠ permission ≠ responsibility ≠ execution ≠ institutional consequence.** These elements may relate closely. They should never be treated as interchangeable merely because one person carries several of them. *** #### 18.1.2 Zero trust protects accomplished leaders from ambiguous responsibility Senior leaders are particularly vulnerable to role ambiguity because others often assume that prominence implies wider authority. A prominent National Council Member may be asked to speak as though they represent the entire National Nexus. A highly respected Chair may be assumed to approve a programme they merely discussed. A governor may be treated as though their governance role extends across all Nexus institutions. A technical specialist may be expected to stand behind work outside the scope of their assignment because their name appears near it. Zero-Trust Leadership protects the leader as well as the institution. It creates a system in which responsibility can be traced to the actual capacity, assignment and institutional context rather than expanded informally around the person's reputation. This allows senior leaders to contribute deeply without becoming responsible for everything that occurs around them. *** #### 18.1.3 Zero trust protects the federation from authority leakage The Nexus architecture deliberately connects institutions without collapsing them into one institution. That design becomes fragile if leadership roles are allowed to migrate informally across organizational boundaries. A Council Chair should not acquire responsibilities belonging to a Board merely because the individual participates in both environments. GCRI Canada should not acquire the governance authority of GRF or GRA merely because it operates common NLS infrastructure. A Regional leader should not acquire responsibility for a National institution merely because they participate in the same federation. Zero trust therefore provides one of the operating disciplines through which **coordination without institutional collapse** becomes practical. The architecture can remain deeply connected because the system preserves enough clarity about which capacity belongs where. *** #### 18.1.4 Zero trust applies to people, systems and claims The doctrine applies not only to formal roles but to the wider leadership environment. A system should not infer authorization from a user profile. A public profile should not convert participation into endorsement. A Ledger entry should not become a certificate. An AI-generated recommendation should not become institutional approval. A Foundry entitlement should not become authority. An introduction should not become partnership. A test should not become implementation. A contribution claim should not become verification merely because it appears in the system. Zero trust therefore connects identity architecture, evidence architecture and institutional architecture. The common question is: > **What institutional fact actually exists, who owns that fact, and what does that fact legitimately permit us to conclude?** *** #### 18.1.5 Architecture is not authority The governing doctrine underlying Part XVIII remains: > **Architecture is not authority.** NLS provides shared infrastructure, common records, leadership pathways, evidence states, Councils, Foundry environments and federation interfaces. These capabilities make coordination more coherent. They do not create authority merely through their existence. The more sophisticated the architecture becomes, the more important this distinction becomes. Powerful systems can create the appearance of authority even where the underlying institutional fact has not changed. Zero-Trust Leadership ensures that technical or institutional sophistication does not silently create responsibilities the system was never entitled to create. *** ### 18.2 Identity and Capacity #### 18.2.1 Person Identity is the foundation, not the complete institutional state NLS begins with **Person Identity** because the system must know which individual is participating. Identity answers the question: **Who is this person?** It does not answer: **What are they entitled to do?** A person's verified identity should therefore remain separate from the several institutional states that may later attach to them. The same person may be a Council Member, Working Group Lead, external executive, Board nominee, formal governor and separately contracted professional at different times or simultaneously. NLS should preserve one coherent person identity while maintaining those capacities as separate institutional facts. *** #### 18.2.2 Institutional Affiliation is distinct from Nexus standing A person's employer, professional institution, university, public office or other affiliation is an important part of institutional context. It does not itself create standing within NLS. Likewise, NLS membership does not convert the member into a representative of their external institution unless that external institution has actually established such a capacity. We therefore preserve **Institutional Affiliation** separately from **Membership Standing**. This allows the system to say accurately that a member is affiliated with a major institution without claiming that the institution itself has entered a formal Nexus relationship merely because one of its leaders participates individually. That distinction is essential to accurate institutional representation. *** #### 18.2.3 Membership Standing is its own institutional fact Membership Standing describes the person's current formal relationship with NLS. It may indicate that the person is active, paused, alumni, former or in another legitimate membership state established through the system. Standing does not describe everything the person does within Nexus. An active member may hold no Council office. Another may be a Chair. Another may lead a Working Group. Another may also hold a separate professional assignment. The standing object therefore answers one narrow but important question: **What is this person's current membership relationship with NLS?** It should not become a container into which every other responsibility is collapsed. *** #### 18.2.4 Council Assignment identifies the leadership environment in which the member participates A Leadership Council Member should have a clear **Council Assignment** identifying the National, Regional or Global Council through which their primary NLS leadership relationship is organized. Council Assignment does not imply exclusive contribution. A National member may contribute to a Regional Working Group. A Global member may support a National Mission. A Regional leader may participate in a cross-Regional initiative. The Council Assignment provides institutional grounding. Additional interfaces describe how the member contributes beyond that home. This distinction allows the federation to remain flexible without losing the context necessary to understand where the person's principal leadership relationship sits. *** #### 18.2.5 Council Office is separate from Council Assignment A member may be assigned to a Council without holding an office within it. Where the person becomes Chair, Vice-Chair, Rapporteur or Working Group Lead, that office should be represented separately. This preserves the underlying Council membership when the office later concludes. It also prevents the system from treating every Council Member as though they possess the responsibilities associated with the officeholder. The principle is simple: > **Membership identifies belonging. Office identifies an additional function.** The two should remain connected without becoming the same fact. *** #### 18.2.6 Institutional Capacity identifies the responsibility a person actually holds in a particular institution A person's **Institutional Capacity** describes the role through which they participate inside a particular organizational context. For example, a person may be an external executive in one institution, a Leadership Council Member in NLS and an appointed governor of a specific Nexus entity. These facts should remain distinct. Institutional Capacity matters because the same person's responsibilities differ according to the institution in which they are acting. A director of one organization does not thereby become a director of another. A Council Chair does not become the executive head of the institution supporting the Council. Capacity remains bounded by institutional context. *** #### 18.2.7 Delegation is a separate fact from position In some circumstances, a person may receive a defined **Delegation** to perform a specific function or represent an institution in a bounded context. Delegation should not be inferred simply because the person holds a senior title. A Council Member asked to attend an institutional meeting does not automatically possess the ability to make commitments on behalf of every Nexus institution. A Chair may communicate Council views while remaining unable to bind another entity. Where delegation matters, the relevant institution should establish it sufficiently clearly. Position describes the person's office. Delegation describes a specific responsibility or permission that may or may not accompany that office. *** #### 18.2.8 Contractual Assignment is a distinct capacity Where a Council Member performs separately constituted professional work, the system should represent the **Contractual or Professional Assignment** independently from membership and Council office. This prevents one role from silently determining the other. A member contracted to provide technical assistance is responsible for the scope established by that assignment. Their Council standing does not expand the professional scope. The professional assignment does not give them broader Council responsibility. This distinction allows Nexus to use the same person's capability in several legitimate ways while maintaining clarity over which relationship applies at a particular moment. *** #### 18.2.9 Governance State remains distinct until formal appointment The governance pathway described in Part XVI introduces several states before actual governance service exists. Eligibility for consideration, Pre-Nomination Review and Formal Nominee are not the same as an active Board appointment. The system should therefore preserve **Nomination State** and **Board or Governance Appointment** separately. Only the competent institution can create the underlying governance fact through its valid process. Foundry, the Leadership Ledger or a profile field can represent that fact once it exists. They cannot manufacture it merely by changing the representation. *** ### 18.3 Standing #### 18.3.1 Standing answers whether the leadership relationship is currently active and coherent We use standing to represent the current institutional condition of the member's relationship with NLS. Standing may influence whether the person can participate in particular Council processes, enter certain pathways or receive particular forms of support. It should remain visible enough that both the member and institution understand the current relationship. Standing is nevertheless narrower than reputation, contribution quality or authority. A member in good standing is not thereby the best person for a particular opportunity. A member with significant verified contribution may still hold no Council office. A former member may retain an important institutional history while no longer possessing active standing. These facts should remain intelligible independently. *** #### 18.3.2 Good standing is not a universal authorization Certain pathways require good standing because it demonstrates that the underlying membership relationship is sufficiently stable. Governance eligibility, Council-office consideration or some opportunity pathways may therefore use good standing as a condition. Good standing should never be interpreted as universal permission. It does not authorize the member to represent Nexus in every setting, access every information environment, make programme commitments, appoint others or exercise responsibilities belonging to another institution. The state is necessary for some purposes. It is not sufficient for every purpose. *** #### 18.3.3 Standing should reflect current state without erasing history A member may move from Active to Pause, from Active to Alumni or from one Council assignment to another. The current system should reflect the new state accurately. The earlier history should remain available where it forms part of the institutional record. This allows NLS to preserve both **current truth and longitudinal continuity**. A member should not appear currently active merely because they served prominently in the past. Nor should a transition out of active membership erase the genuine contribution made during earlier years. *** #### 18.3.4 Standing should be established by the relevant institutional process A member should not be able to create or upgrade standing merely by editing a profile or selecting a preference in Foundry. Standing is an institutional fact. The system may allow a member to request a change, update personal information or initiate a renewal process. The resulting state should still be established through the appropriate NLS process. This distinction between **user input and institutional state** is central to zero-trust architecture. A digital interface can initiate a process. It should not silently convert a request into an institutional fact where human or institutional confirmation is required. *** ### 18.4 Seniority, Reputation and Influence #### 18.4.1 Seniority creates context, not universal authority NLS includes leaders with substantial professional seniority. Their experience and institutional influence can create enormous value. The architecture should benefit from that capability without assuming that seniority itself authorizes action. A chief executive participating in a Council remains one member of the Council unless another legitimate capacity applies. A globally recognized expert may possess extraordinary knowledge without holding an institutional office. A former public official may contribute exceptional state-level understanding without representing the current government. Seniority informs how the institution understands the person's experience. It does not replace the need to establish the actual Nexus capacity in which they are participating. *** #### 18.4.2 Reputation should not substitute for evidence Highly accomplished leaders may receive greater initial credibility because of their professional history. That is understandable. Material NLS claims should nevertheless remain connected to evidence. A distinguished scientist can make a weakly supported claim. A new Council Member can make an exceptionally well-supported one. A renowned executive can misunderstand a National system. A less visible specialist may possess the decisive knowledge required by a particular question. Zero-Trust Leadership protects the Council from converting reputation into proof. Professional stature matters. Evidence still matters separately. *** #### 18.4.3 Influence should be visible enough to manage concentration Informal influence can shape institutions as strongly as formal office. A founder, major relationship-builder, significant economic supporter, highly visible Chair or globally prominent leader may influence outcomes even without formal decision authority. NLS should not pretend such influence does not exist. The institution should remain capable of recognizing when decision processes, opportunities or strategic attention are becoming excessively concentrated around one person or small group. Zero trust therefore applies to **informal power as well as formal role**. The objective is not to eliminate influence. It is to prevent influence from becoming an unexamined substitute for institutional process. *** #### 18.4.4 Prestige should not expand access automatically A highly prominent member should not receive broader technical or institutional access merely because staff assume that senior people should be able to see everything. Information access should follow legitimate purpose and active capacity. This protects the institution from accidental overexposure and protects the leader from receiving information they did not need or expect to hold. The same discipline should apply to founders, Chairs, governors and major institutional partners. Zero trust is most meaningful when it applies precisely where social pressure to make exceptions is greatest. *** ### 18.5 Participation, Support and Economic Contribution #### 18.5.1 Participation creates relationship, not control Annual NLS participation establishes a leadership relationship through which members receive access to the relevant Council, intelligence, development, Foundry and other institutional support described elsewhere in this Handbook. Participation does not purchase control over Nexus institutions, programmes, evidence or outcomes. This remains true regardless of the scale of the member's economic or institutional contribution. Financial support can sustain institutional capacity. It should not alter the meaning of the Council relationship. The Council remains a leadership environment rather than a shareholder assembly or procurement mechanism. *** #### 18.5.2 Economic contribution should not create authority A member or institution may provide substantial financial support to Nexus activities. That support may be deeply valuable. Zero-Trust Leadership requires us to distinguish the economic relationship from the authority relationship. Funding does not create Board standing. Sponsorship does not create research conclusions. Participation does not create procurement preference. Institutional support does not create control over a National Portfolio. A larger economic contribution does not create greater Council authority merely by virtue of size. Our operating principle remains: > **Support the arena. Never buy the outcome.** *** #### 18.5.3 Access benefits do not become consequential permission Participation may include access to specific NLS environments, briefings, Foundry tools or events. Access to those benefits should not be interpreted as authorization to perform consequential institutional acts. A member may be able to view a Portfolio without becoming its owner. They may participate in Nexus Universe without becoming the programme authority. They may have access to a Council workspace without being entitled to speak for the Council publicly. This is the distinction captured by the rule: > **Entitled does not mean authorized.** Entitlement describes what the relationship makes available. Authorization describes what the institution has actually permitted the person to do. *** #### 18.5.4 Sponsorship and leadership standing should remain separated Where a member's institution also sponsors an initiative or Nexus Universe activity, the individual may legitimately operate in both leadership and sponsor-related contexts. The architecture should preserve the distinction. Sponsorship should not increase the person's authority within the Leadership Council or guarantee preferred treatment within evidence, procurement, technology selection or programme design. Likewise, Council standing should not be used to imply that sponsorship has a wider institutional endorsement than actually exists. The same person may connect several relationships. The system should keep the relationships intelligible. *** ### 18.6 Claims #### 18.6.1 Leadership claims are institutional objects requiring context NLS generates many kinds of claims. A member may claim contribution. A Council may state that a Working Group produced an output. A programme may claim that a capability has been tested. A public profile may describe a member's role. A National Nexus may describe an institutional relationship. Every consequential claim should be interpretable according to its source, evidence, scope and state. Zero trust therefore applies to language. A statement should not be allowed to imply a stronger institutional condition than the underlying evidence supports. This is why the difference between participation, collaboration, validation, adoption, implementation and institutionalization matters. *** #### 18.6.2 Self-description does not create institutional fact Members should be able to maintain accurate biographies, interests and professional information. They should not be able to create official NLS titles, verified contributions, Board states, Council offices or representation authority merely through self-description. The system may accept user-submitted information for review. The authoritative institutional state should come from the appropriate source. This is another expression of the rule established in Part XI: > **A human can claim. They cannot self-verify where verification is required.** *** #### 18.6.3 Public claims should follow the narrowest accurate description Where several possible descriptions exist, public language should remain proportionate to what is actually established. A member who participated in a programme should not automatically be described as having led it. A Working Group recommendation should not be described as adopted until institutional uptake exists. A dialogue with a government should not be represented as government mandate. A contribution to finance-readiness should not be described as having secured finance. Precision protects institutional credibility. Strong work does not become weaker merely because it is described accurately. *** #### 18.6.4 Claims should remain correctable Claims can change as evidence improves. A programme initially described as successful may reveal limitations. A member's contribution may prove broader or narrower than first understood. An institutional relationship may evolve from dialogue into formal collaboration. The system should therefore preserve correction without allowing historical narrative to become permanently detached from current evidence. A corrected claim is not necessarily evidence of earlier institutional failure. It can be evidence that the system is capable of learning. *** ### 18.7 Active Capacity Context #### 18.7.1 Active Capacity tells the system who the person is in this interaction The same person can hold several legitimate roles. NLS therefore uses **Active Capacity Context** to identify which capacity explains the person's participation in a particular interaction, workspace, meeting, assignment or institutional process. A member may enter one environment as Council Member, another as Chair, another as contracted technical adviser and another as formal governor. The person does not change. The institutional context does. Active Capacity helps the system preserve that distinction. *** #### 18.7.2 Active Capacity should affect what the person sees and can do Where the distinction materially affects information or responsibility, Foundry and related systems should use Active Capacity to shape access and workflow. A person acting as Council Member may require Council materials but not Board-restricted records. A person acting as governor may require governance information relevant to that entity. A contracted professional may need access to programme data unavailable through ordinary Council membership. The system should therefore avoid the simplistic model in which every privilege attached to a person is available in every context. Access should follow **who the person is acting as, for what purpose, inside which institutional environment**. *** #### 18.7.3 Active Capacity should be visible enough to reduce ambiguity Users should not be required to understand an invisible technical permissions model in order to participate safely. Where several capacities are relevant, the interface should make the active context intelligible enough that the person understands how they are currently participating. This may involve clear workspace context, role indicators, institutional labeling or other appropriate design mechanisms. The objective is human clarity. A zero-trust system that technically separates roles but leaves the human participant uncertain about which role is active remains incomplete. *** #### 18.7.4 Active Capacity should not be chosen freely where institutional state determines it A user should not be able to activate a Board capacity, Council office or professional assignment that the institution has not actually established. The platform may allow selection among capacities the person legitimately holds. It should not allow users to create those capacities independently. This distinction is essential. The interface can expose legitimate states. It should not become the source of the underlying authority fact. *** #### 18.7.5 Meetings and records should retain active institutional context The same leader may participate in several meetings on the same day in different capacities. The institutional meaning of each meeting should remain clear. A National Leadership Council meeting is not a Board meeting because one participant happens to be a director. A technical-assistance session is not Council deliberation merely because several Council Members attend. A Regional Working Group is not a Global Council proceeding because a Global leader participates. The convening institution and active capacities determine the meaning of the record. This discipline is fundamental to a federated system. *** ### 18.8 Institutional Responsibility #### 18.8.1 Responsibility should remain with the institution that actually holds it Nexus connects many organizations through common systems and methods. Zero-Trust Leadership requires the system to preserve which institution actually owns the relevant responsibility. GCRI may own evidence or technical-assistance functions. GRF may carry leadership and institutional-learning functions. GRA may carry finance-readiness functions. GCRI Canada may operate the shared NLS infrastructure. A National institution may own a particular country programme. A Board may hold formal governance responsibility for its entity. Shared infrastructure should not cause these responsibilities to migrate silently. The institutional owner should remain identifiable. *** #### 18.8.2 Coordination should not be confused with institutional ownership One organization may coordinate a process involving several institutions. That coordination does not automatically make it the substantive owner of every component. GCRI Canada may coordinate onboarding, Leadership Ledger administration, calendars, Council operations and other common NLS functions through a Joint Coordination Office or equivalent shared-service layer. The existence of that operating role does not make GCRI Canada the governing authority of GRF or GRA. Similarly, a Regional Hub may coordinate several National systems without becoming the owner of their National Models or Portfolios. The principle is: > **Coordination is a function. Ownership is a separate institutional fact.** *** #### 18.8.3 Hosting should not create authority A Nexus institution may host technology, data, meetings, Secretariat functions or shared infrastructure for others. Hosting can create operational centrality. It should not be interpreted automatically as institutional supremacy. A cloud environment hosting several functions does not own the substantive decisions represented through those functions. A Secretariat maintaining records does not become the authority responsible for the decisions recorded. This distinction becomes increasingly important as common Nexus infrastructure becomes more technically integrated. Operational convenience should not rewrite institutional structure. *** #### 18.8.4 Technology should not become the source of institutional responsibility Foundry can represent roles, Plans, Council states, governance appointments and professional assignments. Those digital objects should reflect institutional reality. They do not create the reality by themselves. Changing a database field cannot create an appointment whose underlying institutional process never occurred. Granting an application role should not establish delegation that the competent institution never issued. The system should therefore treat technology as a **representation and enforcement layer around institutional facts**, not as the source from which those facts derive. *** #### 18.8.5 Handoff preserves responsibility through transition A mature Nexus process frequently ends with a handoff from one institutional environment to another. A Council may develop a proposition. Foundry may support testing. Universe may generate evidence. A public institution, enterprise, programme organization or another competent actor may then become responsible for execution. The handoff should identify what is moving and what is not. The fact that Nexus helped develop the proposition does not mean it remains responsible for every subsequent implementation decision. Handoff enables continuity precisely because responsibility can change while context and evidence remain connected. *** ### 18.9 Access #### 18.9.1 Access should follow purpose, context and legitimate capacity NLS should provide leaders with the information and tools required to perform their legitimate functions. Access should therefore be designed according to institutional purpose rather than generalized seniority. The relevant system may consider role, institutional attributes, relationships, active capacity, geography, programme assignment, information sensitivity and the purpose for which access is required. This creates a more mature model than a simple hierarchy in which senior users can access everything below them. Federated institutions are not arranged in one universal ladder. Access architecture should reflect that reality. *** #### 18.9.2 Least necessary access supports trust Members should receive enough access to contribute effectively. They do not need unrestricted access to every Nexus environment merely because they are trusted individuals. Limiting access to what is relevant reduces accidental disclosure, cognitive overload and ambiguity regarding institutional responsibility. This is not a judgment about the person's integrity. It is a design principle. Even highly trusted leaders benefit from clear information boundaries because those boundaries reduce the burden of determining individually what may or may not be used in each context. *** #### 18.9.3 Access should be contextual rather than static where necessary A member's access needs can change according to the work being performed. A Council Member joining a temporary Mission may require additional programme information for the duration of that role. A governor may lose governance access when the formal term concludes. A professional assignment may require restricted technical information that ordinary Council membership does not provide. The system should therefore be capable of adjusting access as legitimate capacities change. Access that remains permanently attached after the underlying purpose ends creates unnecessary risk and weakens institutional clarity. *** #### 18.9.4 Senior role should not create cross-entity administrative bypass No Council Chair, Global leader, founder, major supporter or other prominent person should receive unrestricted cross-entity access merely because their position is considered important. Where broader access is required, the institutional purpose should be established. This is particularly important in a federated architecture involving independent institutions. A person can be extraordinarily senior within one context while remaining an ordinary participant or external party in another. The system should respect that distinction. *** #### 18.9.5 Recusal or role change may affect access where appropriate Where a member steps aside from a matter or changes capacity, access may need to change accordingly. This should be proportionate to the information and role involved. The objective is not to punish the person. It is to ensure that the digital environment reflects the current institutional context. Zero trust becomes operational when access and responsibility evolve together rather than leaving old permissions in place because changing them is inconvenient. *** ### 18.10 Multiple Capacities #### 18.10.1 Multiple capacities are normal in senior leadership systems NLS is deliberately designed for accomplished leaders who operate across institutions. Multiple capacities should therefore be expected rather than treated as an anomaly. A member may be a National Council Member, company executive, university governor, Working Group Lead and separately assigned Nexus adviser simultaneously. Another may be a Regional Chair and formal governor of one Nexus institution. Another may hold a public role while remaining a member in a carefully bounded capacity. The architecture should make these relationships manageable. The alternative would be to exclude precisely the experienced leaders NLS seeks to convene. *** #### 18.10.2 Multiple roles should not be collapsed into one "super-role" Digital systems often simplify by aggregating permissions. NLS should resist creating a generic high-privilege identity that combines every responsibility held by the person. Such a model may be convenient technically while being institutionally dangerous. The member would appear capable of carrying governance, Council, professional and programme responsibilities simultaneously in every context. Instead, the system should preserve each legitimate capacity and activate the appropriate one according to purpose. This maintains institutional meaning as complexity increases. *** #### 18.10.3 Role accumulation should be reviewed for concentration risk The fact that a person is capable of carrying several roles does not mean the institution should assign all of them. Repeated concentration of Council office, governance, programme leadership, professional work and key relationships in one individual can create dependency and informal power beyond what the formal architecture suggests. NLS should therefore examine whether responsibility can be distributed more effectively. The objective is not artificial fragmentation. It is institutional resilience. Strong leaders should help develop systems in which other capable people can also carry consequential responsibility. *** #### 18.10.4 Multiple capacities require careful attribution Where one person contributes to the same programme through several capacities, the Leadership Ledger should preserve enough context to understand what they did in each. A member may help shape a concept through Council work and later deliver technical assistance under a separate assignment. Those contributions are related. They are not the same. Clear attribution allows Nexus to recognize the full value of the leader without obscuring whether the work was non-executive contribution, professional delivery or another institutional function. *** #### 18.10.5 Capacity changes should not rewrite earlier history A Council Member later becoming a governor does not retroactively transform their earlier Council contributions into Board activity. A Chair later taking a professional assignment does not mean earlier Chair work was contractual. The historical record should preserve the capacity in which the person acted at the time. This is important for institutional truth. Current status should not be projected backward into earlier periods merely because the person's later role became more prominent. *** ### 18.11 Human Review #### 18.11.1 Consequential state changes require appropriate human institutional judgment Foundry and AI can support NLS significantly. They can identify relevant evidence, suggest potential matches, surface role conflicts, summarize history, prepare reviews and detect inconsistencies. They should not autonomously create consequential leadership states. AI should not appoint a Chair, verify its own contribution claim, clear a material compatibility issue, select a Board member, award a professional assignment or authorize institutional representation. These decisions involve context, responsibility and institutional judgment extending beyond pattern matching. Technology should therefore support the responsible human institution rather than replace it. *** #### 18.11.2 Human review should focus on consequence Not every system change requires a committee. The level of human review should be proportionate to the significance of the state being created. Updating a contact preference requires little institutional intervention. Establishing a Council office, verifying a significant contribution, creating a separate professional assignment or recording an actual Board appointment requires substantially more assurance. This principle keeps Zero-Trust Leadership practical. The objective is not to maximize friction. It is to apply deliberate human judgment where the institutional consequence justifies it. *** #### 18.11.3 Human reviewers should see evidence and context Human involvement is not sufficient by itself if reviewers lack the information required for good judgment. The system should provide enough evidence, role context, history and relevant relationships for the reviewer to understand what is being decided. A professional assignment reviewer may need to understand Council standing and other active capacities. A Council-office review may need to examine contribution history. A governance process may need information about current assignments. Human judgment becomes stronger when the architecture supplies coherent context. Zero trust is therefore a combination of **evidence, system design and human responsibility**. *** #### 18.11.4 AI recommendations should remain visibly advisory Where AI is used to suggest candidates, identify relevant evidence or summarize a leadership record, users should understand that the output is advisory. Generated synthesis may contain error, omit context or reproduce bias embedded in the available evidence. The system should preserve the ability to examine the underlying source material where material. A polished AI recommendation should never become more authoritative than the evidence it interprets. This is especially important in leadership environments because apparent fluency can create disproportionate confidence. *** #### 18.11.5 Human review should itself remain reviewable Human institutional judgment can also be wrong. Zero trust should not become a doctrine in which algorithmic judgment is distrusted while human judgment is treated as infallible. Material decisions should therefore remain capable of appropriate correction, reconsideration or later review where new evidence emerges. This creates a balanced architecture. Technology does not become the sovereign judge. Neither does one human decision become permanently immune from correction merely because a person made it. *** ### 18.12 Correction #### 18.12.1 Zero-trust systems must be correctable Identity and capacity records inevitably change. A professional affiliation may be outdated. An office term may have concluded. A nomination state may have been represented incorrectly. A member may discover that an assignment remains visible after completion. The architecture should therefore provide mechanisms through which material inaccuracies can be identified and corrected. Correction is not a failure of the system. It is part of maintaining trustworthy institutional state over time. The alternative is a platform that gradually accumulates stale authority signals around people whose real responsibilities have changed. *** #### 18.12.2 Correction should address the authoritative source Where possible, correction should occur at the source that owns the relevant fact rather than through repeated downstream edits. If the issue concerns Council Standing, the NLS standing record should be corrected. If it concerns a formal Board appointment, the competent institution's governance record should establish the truth. If it concerns professional affiliation, the relevant identity record should be updated. Downstream views should then receive the corrected state through governed propagation. This reflects the Nexus doctrine: > **One fact family → one authoritative owner → many governed projections.** *** #### 18.12.3 Corrections should preserve significant history Correcting current state does not require erasing valid historical states. A person who served as Chair last year should no longer appear as current Chair, but the historical office remains part of the Leadership Ledger. A former governor should not retain active governance access, but their past governance service remains legitimate institutional history. The system should therefore distinguish **current state from historical record**. This allows correction without institutional amnesia. *** #### 18.12.4 Incorrect authority signals should be treated seriously An outdated biography may be inconvenient. An outdated authority signal can create wider consequences. If a person is still shown as holding an office, delegation or governance capacity that has ended, other users may rely on that representation inappropriately. NLS should therefore prioritize correction of states capable of affecting access, responsibility, representation or institutional decisions. The risk lies not only in inaccurate data. It lies in the actions others may take because the inaccurate data appears authoritative. *** #### 18.12.5 Correction should propagate across dependent environments Where a material capacity changes, related access, public profiles, Council interfaces and relevant records should update coherently. A concluded Board term should not disappear from one interface while continuing to grant governance privileges in another. A Council-office transition should not update the public page while leaving operational workflows assigned to the former officeholder. This is one of the strongest practical reasons for common NLS architecture. Shared infrastructure should make authoritative correction easier, not create additional contradictory copies. *** ### 18.13 Continuity of Context #### 18.13.1 NLS should preserve the person's journey without flattening the states within it A leader may participate in Nexus over several years, institutions and capacities. The system should preserve one intelligible longitudinal history without reducing that history to one permanent title. The member may have been a National Council Member, later Chair, then Regional contributor, subsequently a Board nominee, later a governor and eventually an alumnus. Each state belongs to the same person's history. None should be allowed to rewrite the meaning of the others. Continuity therefore means **one person, many time-bounded institutional states**. *** #### 18.13.2 Institutional context should travel with material records Where a contribution, decision or evidence object moves across Nexus environments, the context required to interpret it should remain connected. A Council recommendation entering a National Portfolio should still be identifiable as a Council recommendation. A Universe test entering the Leadership Ledger should retain its test context. A professional assignment informing future opportunity matching should remain identifiable as professional delivery rather than ordinary Council work. This prevents information from becoming stronger merely because its original context was lost during transfer. Context is part of institutional meaning. *** #### 18.13.3 Federation depends on continuity of provenance As National, Regional and Global systems become more interconnected, the same information may appear in several environments. Users should still be able to understand where the underlying fact originated and which institution maintains it. This is especially important when a shared Foundry experience creates the visual appearance of one seamless institution. The user interface may be coherent. Institutional provenance should remain intact underneath it. Federation becomes trustworthy when connectivity increases without erasing origin. *** #### 18.13.4 Leadership history should support future judgment without creating permanent privilege A strong longitudinal record makes the member's experience easier to understand. It should not create an irreversible status hierarchy in which historical prominence permanently guarantees future opportunity, access or office. Past contribution is evidence. Current institutional fit remains a separate question. An exceptional former Chair may be the right person for a future Regional Mission. Another leader may now possess the stronger capability for the work. Continuity should improve judgment. It should not freeze the federation around its earliest leaders. *** #### 18.13.5 Context continuity enables responsible automation As Foundry becomes more capable, automated systems can use leadership context to improve relevance. Leadership Intelligence can be personalized to the member's geography and Plan. Opportunity routing can identify relevant experience. Access can follow active capacity. AI can summarize the correct institutional history. These capabilities are safe only if the underlying context remains accurate. Automation operating on flattened or stale role data can scale ambiguity rapidly. Zero-Trust Leadership therefore treats contextual data quality as part of institutional infrastructure, not merely technical administration. *** #### 18.13.6 The zero-trust leadership proposition The complete architecture can therefore be expressed as: > **Identify the person → establish the relationship → establish the capacity → verify the institutional state → determine the purpose → provide proportionate access → preserve active context → record evidence → enable human review → correct when necessary → retain historical continuity** At no point should the system assume that one state automatically creates another. Identity does not create standing. Standing does not create office. Office does not create delegation. Participation does not create professional assignment. Nomination does not create governance. Access does not create authority. Capability does not create permission. Permission does not prove execution. Execution does not automatically create institutional outcome. This separation is not administrative complexity for its own sake. It is what allows a sophisticated federation of powerful people and institutions to remain coherent as it grows. *** ## PART XVIII FRAMEWORK PRINCIPLES **Verify before inference.** We treat consequential leadership states as institutional facts that must be established through the appropriate source rather than inferred from reputation, payment, access, proximity, technical profile or another adjacent state. Identity, standing, Council office, delegation, professional assignment and formal governance are related but distinct. The architecture becomes trustworthy because it refuses to convert one silently into another. **Context before access.** Access should follow the purpose for which the leader is participating, the active capacity they legitimately hold and the institutional environment responsible for the work. Seniority does not create universal access, and entitlement to a system or benefit does not itself authorize consequential action. The stronger the federation becomes, the more important contextual access becomes. **One person, multiple legitimate capacities.** NLS is designed for leaders who operate through complex professional lives. We preserve Person Identity while maintaining Institutional Affiliation, Membership Standing, Council Assignment, Council Office, Institutional Capacity, Delegation, Contractual Assignment, Governance State and Active Capacity Context as differentiated facts. Multiple roles can create value, but they should remain intelligible enough that one person's prominence never becomes a hidden super-role spanning the federation. **Human institution over platform convenience.** Foundry, AI and automation can enforce access, surface evidence, identify inconsistencies, support matching and make complex role architectures usable. They should not autonomously manufacture leadership authority, verify consequential self-claims, appoint officeholders, select governors or award professional work. Technology represents and supports legitimate institutional state. The competent human institution creates the consequential state. **Continuity with correction.** Leadership context must remain current without erasing valid institutional history. Significant role changes should propagate through dependent systems, stale authority signals should be corrected promptly, and historical service should remain visible as history rather than current privilege. One governed fact family should support the appropriate member, Council, operational, public and governance views without creating contradictory underlying truths. *** ## OPERATING RELATIONSHIP Part XVIII provides the identity, capacity and authorization discipline required for the architecture established in Parts XIV through XVII to operate safely at scale. The Year-One Gateway can create several legitimate pathways. Council Members can remain substantive members, assume Council office, enter governance consideration, undertake a separate professional assignment, contribute across federation levels or combine several compatible roles. Without a zero-trust model, these legitimate overlaps would gradually become ambiguous. NLS therefore separates **Person Identity, Institutional Affiliation, Membership Standing, Council Assignment, Council Office, Institutional Capacity, Delegation, Professional Assignment, Governance State and Active Capacity Context**. These objects describe different institutional facts and should remain independently verifiable even when attached to the same person. The Leadership Ledger preserves their history. Foundry represents the current state and supplies the relevant operating context. Access follows institutional purpose and active capacity rather than generalized seniority. The member may possess several legitimate entitlements while being authorized to perform only the actions appropriate to the current context. This doctrine is especially important across GCRI, GRF and GRA. GCRI Canada operates the common NLS infrastructure and may coordinate shared leadership processes, but common infrastructure does not collapse the institutions into one authority. A formal governance fact belongs to the competent institution. A National programme belongs to the appropriate National or operating environment. A professional assignment belongs to the institution that creates it. The same principle governs claims. Participation is not adoption. Introduction is not partnership. Testing is not implementation. Submission is not approval. Finance-readiness is not finance. Insurance-readiness is not underwriting. Nomination is not appointment. Council office is not Board office. Access is not authorization. These are not semantic distinctions detached from operations. They determine how people are represented, which information they can access, how contributions are attributed, what decisions can legitimately be made and which institution remains responsible afterward. The governing proposition of Part XVIII is therefore: > **Nexus can support leaders who operate across many institutions, roles and systems only if the architecture remains capable of identifying precisely who they are, which capacity is active, what that capacity permits, which institution owns the responsibility and what evidence supports the resulting institutional state. Zero trust allows complexity without ambiguity.** ## NEXT ## PART XIX: LEADERSHIP INTEGRITY ### Conflicts, Recusal, Anti-Capture, Public-Institution Engagement, Competition, Procurement Neutrality, Specialized Interfaces, Cross-Border Leadership, Responsible Technology, Community and Rights Considerations, Concerns, Conduct and Fair Process Part XIX will establish the integrity architecture through which NLS manages the realities of senior leaders operating across institutions, sectors and jurisdictions. It will define conflicts and recusal as contextual tools rather than blanket exclusions, address related interests and anti-capture, establish disciplines for government and public-institution engagement, preserve competition and procurement neutrality, define integrity expectations around finance, insurance and other specialized interfaces, address public claims, confidentiality, responsible advanced technology, communities and protected knowledge, and establish the principles through which concerns, grievances, conduct questions, review and reconsideration are handled fairly and proportionately. ## Sources 1. ISO (2018). ISO 31000:2018 Risk management — Guidelines. Geneva: International Organization for Standardization. [www.iso.org/standard/65694.html](https://www.iso.org/standard/65694.html) 2. OECD (2014). Recommendation of the Council on the Governance of Critical Risks. OECD/LEGAL/0405. [legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0405](https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0405) 3. UN General Assembly (2024). The Pact for the Future, with the Global Digital Compact. A/RES/79/1. [undocs.org/A/RES/79/1](https://undocs.org/A/RES/79/1) **Standards that apply.** Masters: [Communities, Learning and Contribution](https://nexustandards.com/communities/) (PLANNED); [Governance, Security and Society](https://nexustandards.com/society/) (PLANNED); [Trust, Verification and Assurance](https://nexustandards.com/assurance/) (PLANNED). Standards: [NS-0](https://nexustandards.com/standards/ns-0/) (PROPOSED), [NS-1](https://nexustandards.com/standards/ns-1/) (PROPOSED), [NS-2](https://nexustandards.com/standards/ns-2/) (PROPOSED), [NS-3](https://nexustandards.com/standards/ns-3/) (PROPOSED), [NS-3b](https://nexustandards.com/standards/ns-3b/) (PROPOSED), [NS-4](https://nexustandards.com/standards/ns-4/) (PROPOSED), [NS-5](https://nexustandards.com/standards/ns-5/) (PROPOSED), [NS-8](https://nexustandards.com/standards/ns-8/) (PROPOSED), [NS-9](https://nexustandards.com/standards/ns-9/) (PROPOSED), [NS-10](https://nexustandards.com/standards/ns-10/) (PROPOSED), [NS-11](https://nexustandards.com/standards/ns-11/) (PROPOSED), [NS-12](https://nexustandards.com/standards/ns-12/) (PROPOSED), [NS-13](https://nexustandards.com/standards/ns-13/) (PROPOSED). Statuses are registry statuses on nexustandards.com, never adoption or certification. **In the GitBook.** [Programme](/organization/programme.md) · [Governance in operation](/organization/governance-in-operation.md) · [Systems](/organization/systems.md) · [Reference](/organization/reference.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.therisk.global/organization/operations/frameworks/nexus-leadership-system-nls/xviii.-zero-trust.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.