A campaign engine built for the hard cases.
Most review tools let you pick a group and a deadline. REVIEWIT lets you define the perimeter by conditions, designate reviewers with a fallback and a quorum, run three kinds of cadence, override fourteen certification rules per campaign, and arm the whole thing atomically with a quote in credits. Then it closes into sealed evidence.
Seven steps, one order, and a rail that tells you what is still open.
Create, edit or duplicate. Once a campaign is launched, the steps that shaped its perimeter are locked, the steps that shape its communication stay open, and the cadence is partially editable: past waves are frozen, future ones are not.
Intention
Solution, then workload, then resource type. A policy chosen as a card, then its criteria. The certification type derives from the policy and is never asked.
Locked after launchIdentity
A title, an optional description, and the compliance objectives the campaign serves, suggested from the policy.
OpenScope
Calculated at each run, or imported from a file. Up to three attribute conditions with six operators, chained with and / or.
Locked after launchReviewers
Four designation modes, an explicit fallback, a decision strategy with quorum, and up to three escalation levels.
Locked after launchCadence
Scheduled, periodic or continuous trigger. A wave flow of reminders, escalations and closure. Template, sender, subject, languages.
PartialRules
Fourteen certification rules with their provenance: default, workspace or campaign. Closure by expiry or by attestation.
Locked after launchReview & launch
A recap with a jump back to any step, a quote in credits against the workspace envelope, simulation or production, start paused.
OpenCertification policies, extensible by design.
Each policy is a campaign extension with its own settings: minimum owners, acceptance required, designation strategy for orphans, thresholds for inactivity. Add your own when your control framework requires it.
A perimeter you can state, and gaps that are named.
The scope is either calculated from the collected estate at each occurrence, or imported as a selection. Conditions are normalised into a signature, so two campaigns that filter the same thing are known to be comparable.
- Conditions. Up to three attribute filters, operators equals, differs, starts with, ends with, contains, does not contain, multi-valued, chained with and / or.
- Sanctuary. Resources placed out of review, in traced cycles with a reason and a deadline. Exclusions are counted in the wizard, and every one becomes a visible finding at freeze.
- Gaps at freeze. Unidentifiable, out of boundary, sanctuarised, orphan, unmatched import lines. Written once, at arming, as findings in the alert centre.
- Frozen, then only shrinking. After the freeze, objects that vanish from collection are put on hold, never deleted. New objects never enter a running occurrence.
Designated, justified, never invented.
Reviewer resolution is a named phase with a justifiable result: designated by this mode, failing that by this fallback. An object with no resolvable reviewer produces a finding and no request. The engine never makes up an address.
- Four modes. Owners of the resource, the manager from the directory, a custom selection, or an attribute carried by the collected object.
- Fallback. Exclude the object, or rely on a manager, the owners or a custom selection.
- Decision strategy. All designated reviewers, at least one, or a quorum in percent, rounded up and capped by the number designated.
- Escalation. Up to three ordered levels, to a manager or a custom selection, driven by the cadence.
- Delegation at assignment. Applied after resolution, so the dossier keeps who was supposed to decide. Co-assigned or transferred, never a second billable decision.
Three triggers, one wave flow, civil dates.
A campaign is a setting; what runs is an occurrence. The trigger decides when occurrences are armed, the wave flow decides what happens inside each one, and everything is computed in civil dates at the workspace time zone, in working days where the rules say so.
- Scheduled. Up to three calendar dates.
- Periodic. Every N months from a criterion such as the creation date. A previous occurrence still open makes the next one skip, not overlap.
- Continuous. Objects are admitted into cohorts as they appear or change, each cohort reviewed on its own clock. Edition-gated.
- Waves. Ordered steps of type reminder, escalation and closure, each an interval in days from the previous one. Closure is always last.
- Pause. Pausing a campaign freezes its occurrences and shifts the calendar by the pause duration. Missed reminders are never replayed on resume.
Fourteen rules, three tiers, and a badge that cannot lie.
Rules are resolved one by one, never as a block: the platform default, then the workspace override, then the campaign override. An override equal to the inherited value is never written, so the provenance badge always tells the truth.
- Decisions. Notify users on revocation. Require a comment for approval, for revocation. Enable consult.
- Challenge. Enable a challenge period and set its default duration.
- Exceptions. Allow temporary exceptions and set the default duration.
- Delegation and bulk. Disable delegation forwarding. Enable bulk approve, bulk revoke, bulk exception, bulk reassignment.
- Sign-off. Require reviewer sign-off of the batch.
- Closure mode. Expire what is undecided, or attest it with a default verdict per policy criterion.
A vocabulary with nuance, and one round trip to contest.
Reviewers decide per criterion when the policy has several, and the strongest reservation wins the aggregate. Escalation and cancellation are transfers, never decisions, and the reporting never confuses the two.
- Exception with a duration. A temporary allowance whose deadline is the civil day of the act plus the duration set by rule.
- Challenge. The resource owner may contest a non-compliance within a window in working days, counted from the latest decision. One round trip: the reviewer upholds or amends.
- Consult. Ask one or several colleagues for advice with a question and a reason. Recorded on the timeline, never a decision.
- Bulk, where allowed. Approve, revoke, exception and reassignment in bulk, each behind its own rule.
- Sign-off lots. Assigned, in progress, ready to sign, pending signature, sealing, attested. Any other transition is refused.
Atomic on the way in, ordered on the way out.
An occurrence is armed in five ordered phases and becomes active only at the end of the fifth. Credits are debited on the frozen snapshot and compensated on failure. Closure is five acts, and the challenge window blocks none of them.
Outcomes are named
Armed, skipped because the previous occurrence is still open, rejected, failed with the debit compensated, already armed, busy. Never a silent nothing.
Watchdog and re-arm
An occurrence stuck in arming for more than an hour is declared dead before anything new is armed. Re-arming is a human gesture, offered only when the last occurrence failed.
Closure in five acts
Stop reminders and escalations, expire or attest what is open, close the findings, mark the occurrence closed, publish the certification dossier. Then seal.
Declared by the engine, delivered by an outbox.
The step engine emits trigger codes. It never sends mail. An outbox resolves the recipient's preferences and language, picks the template in cascade, merges the tokens and hands the message to the provider. Everything it does is replayable and measurable.
- Templates. A local catalogue per workspace and a global one from the platform, by category, language and status, with preview. A template in use cannot be deleted.
- Preferences. Each person toggles assignments, reminders, escalations, digests, challenges. Governance transactionals, such as a raised challenge or a revocation notice, are always sent.
- Languages. Enabled languages with a fallback, normalised whatever the source writes.
- Delivery. Four providers resolved per sender domain, delivery events consolidated, manual replay for operators.
Everything a workspace manager needs to run it.
States you can trust
Not started, paused, active, finished, canceled, archived. Archive is reachable only from finished or canceled. A campaign finishes only after a genuinely closed cycle.
Grid actions
Start now, pause, resume, cancel with a justification, archive, duplicate, recycle, re-arm. Each action propagates to the occurrences underneath.
Campaign detail
Progress by decision family, expected decisions, reviewers, launch and closure calendar with countdown, configuration recap, cost in credits.
Closure panel
Attested lots over total, package download, seal badge and verification per lot, closure rank, coverage, digest and seal reference.
Health detection
Campaigns that stall, overdue reviews and silent occurrences feed the alert centre with thresholds your subscription sets.
Webhooks and API
Campaign events, including a dedicated signed-off event, pushed to your systems. Automation through the public API, never a decision.
Design a campaign with us.
Bring a real perimeter and a real reviewer population. We will build the campaign live, quote it, simulate it, and show you what the sealed evidence looks like at the end.