Zero-Base Policy

The Zero Base Policy Framework is the governing doctrine of the QCE Vision ecosystem. It defines seven operational zeroes, absolute constraints that every system, contract, workflow, and agent in the ecosystem must satisfy. It is binding on all QCE Vision entities (QCE Global, QCE Gateway, QCE Technologies, QCE AI, and QCE 360), on every sub-processor we engage, and on every autonomous agent operating within the substrate.

The framework exists because governance that rests on assumption is governance that fails silently. A policy that says "we try to be secure" cannot be audited. A policy that says "no unauthenticated request reaches any endpoint" can be, and is, every six hours, automatically. The Zero Base Policy Framework is written in the auditable form.

Where a signed agreement between you and QCE Vision sets out additional obligations, those obligations apply in addition to, never in place of, the framework.

Most governance frameworks start from the current state and add constraints. The Zero Base Policy Framework starts from zero and permits only what can be justified. This is the same discipline that governs our architecture (zero-based engineering: no dead code, no orphaned modules, no phantom features) applied to governance.

The doctrine has three operating rules:

• Nothing is assumed. Every capability must be declared, wired, and reachable. If a feature exists in a document but not in the running system, it does not exist.
• Nothing is hidden. Every control maps to an observable signal. Where an operation cannot be observed, it cannot be governed.
• Nothing is permanent. Every constraint is reviewed on a scheduled cadence. Zeroes are absolute in effect but reviewed in form, a zero that no longer protects the ecosystem is amended or retired.

Six zeroes govern the day-to-day operation of every system in the ecosystem. Each maps to a control, an audit cadence, and a remediation path.

The seventh zero is the one that makes the other six possible at scale. Zero Resistance is the principle that the substrate should present as little friction as possible between human intent and system outcome, the way a photon travels without collision, rather than the way an electron collides and generates heat.

In practice, Zero Resistance means: an intent expressed once is carried through every layer of the system without re-translation; a policy written once is enforced everywhere without manual application; a capability added once is reachable by every authorised agent without per-agent wiring. The friction that would otherwise accumulate, the reconciliation meetings, the manual handoffs, the re-keyed data, is designed out of the system rather than managed inside it.

Zero Resistance is the newest of the seven zeroes and the one most closely tied to the substrate's architecture. It is documented in full in the QCE APEX Zero Resistance Architecture, and it is enforced through the same audit and remediation regime as the other six.

The seven zeroes are the substance. The Zero Base Policy Framework is the mechanism that keeps them in force. The framework has four components:

The framework is audited continuously and reported on a fixed cadence. The audit regime has four layers:

• Automated schema audits run every six hours across every endpoint in the substrate. Non-compliant endpoints are invalidated and rebuilt automatically.
• Continuous integrity monitoring tracks the observable signal for each of the seven zeroes. Anomalies are flagged within one monitoring interval.
• Quarterly control reviews examine every declared control against its runtime enforcement, and record any drift between the two. Drift findings are escalated to the responsible function.
• Annual independent audit commissions an external review of the framework's substance and enforcement. The report is made available to enterprise customers under NDA.

Audit records are immutable and retained for the period required by the applicable jurisdiction. They are available to enterprise customers on request and, where relevant, to regulators.

Non-compliance is treated as an engineering finding, not a disciplinary event. The framework's purpose is to detect and correct drift quickly, not to punish the people closest to the drift.

1. Detection. The automated audit or monitoring layer detects the deviation and records it against the affected control.
2. Containment. Where the deviation presents a security or integrity risk, the affected system is isolated automatically. Containment is proportional: it removes the risk without taking down unrelated services.
3. Root-cause analysis. The responsible function investigates the deviation to its fundamental cause, not merely its symptom. A deviation that recurs after a symptom fix is escalated as a systemic finding.
4. Remediation. The system is rebuilt to compliance. Where the control itself was inadequate, the control is amended and the amendment is recorded.
5. Prevention. Where the deviation reveals a class of risk, a new control is added to the framework to prevent the class, not merely the instance.

Every non-compliance event is documented, including its cause, its remediation, and any control added as a result. The documentation is available to enterprise customers on request.

We publish the following reports on a fixed cadence:

• Daily: rolling 24-hour latency and availability metrics across the substrate.
• Weekly: energy and utilisation report covering compute and inference workloads.
• Monthly: infrastructure attestation report, including enclave inventory and the status of each declared control.
• Quarterly: dependency inventory and control-review report, including any drift findings and their remediation status.
• Annually: transparency report covering government requests, security incidents, and remediation actions, and the independent audit report.

Enterprise customers receive the reports relevant to their engagement automatically. Other parties may request reports through their account contact or the Sovereignty Office.

The Zero Base Policy Framework is the doctrinal foundation. Other policies in the ecosystem implement one or more of its zeroes:

• The Data Sovereignty & Residency Policy implements Zero Cloud and Zero Dependency for data.
• The Privacy Policy implements Zero Trust for personal data, and Zero Cloud for custody of that data.
• The Terms of Service implements Zero Tolerance for violations of the acceptable-use regime.
• The Refund Policy implements Zero Waste at the commercial layer, no hidden fees, no dark patterns, no lock-in.
• The Disclaimer implements Zero Tolerance for misrepresentation of the ecosystem's forward-looking statements.

Where a specific policy and the framework appear to conflict, the framework prevails, and the conflict is recorded as a finding to be resolved in the next policy revision.

The framework is reviewed on a scheduled cadence and amended when a zero's substance changes, when a new zero is added, or when the enforcement regime is materially revised. Material changes are announced at least 30 days before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Amendments do not apply retroactively to transactions or engagements completed before the effective date. Where an amendment would materially increase your obligations, we will notify you directly and provide an opportunity to object.

The Zero Base Policy Framework is owned and enforced by our Legal, Sovereignty & Compliance function, one of the nine core business functions that govern the QCE Vision ecosystem. Questions, control-review requests, and audit-report requests are handled by the same function.