This manual is for the people who operate The Nehemiah Layer for your organization — your Platform Managers and operators. It covers everything you do day to day: the decisions the platform makes, how you set your rules, how you approve the actions that need a human, and how you pull the record of any decision. In plain terms: The Nehemiah Layer is the control that decides what your AI and automated systems are allowed to do — before anything actually happens.
1Signing in
Open console.nehemiahlayer.com and enter your operator credential. Your view is scoped to your organization only — you see and manage your own tenant, and nothing from any other customer.
Keep your credential private. It is your identity on the platform. Every action you take — approving a held request, changing a rule — is recorded against you.
2The four decisions
Every action your AI or automated systems attempt is evaluated against your rules before it can happen, and returns one of four decisions:
PermitThe action is allowed. It proceeds.
ConstrainThe action is allowed, but held within tighter limits your rules set.
RejectThe action is not allowed. It is stopped before it can reach your equipment or systems.
EscalateA human must decide. The action is held and waits in the Human Queue until a Platform Manager approves or denies it.
Every one of these decisions — including every denial — is written to a permanent, tamper-proof record you can pull later.
3Setting your rules (Governance)
The Governance page is where you decide what your systems are allowed to do. Nothing is interpreted or guessed — every rule is exact, and your safety-critical rules are hard-locked so no one can switch them off.
Choose from the library. Pick your industry, then check the rules each division needs. Every checked rule becomes a real limit the platform enforces.
Add your own rules. Map a term from your own policy into an explicit rule — the action, the outcome (permit, deny, or escalate), any dollar or numeric limit, and the source document it came from. Enter them one at a time, or bulk-load a spreadsheet.
Set the customer and agent the rules apply to, then Validate to check for conflicts, and Save to put them in force on the next action.
The document is recorded, never interpreted. When you attach the policy a rule came from, it is kept as the record of where the rule originated — the platform does not read it or make decisions from it. You write the rule; the platform enforces it exactly.
4Time, threat-flags & dormant credentials
Beyond dollar and value limits, your rules can act on three built-in facts — useful controls a security team will recognize:
- Time windows. Escalate or deny actions outside approved hours — for example, a change attempted at 3 a.m. or on a weekend.
- Threat flags. If your security team (or your SIEM) flags a credential as suspect — a badge reported lost, an account behaving oddly — a rule can escalate that credential's next action for a human to review. Your tools detect; the platform enforces.
- Dormant credentials. A credential that has been quiet for a set number of days and then suddenly acts is escalated to a human — even if the action itself is within every limit. This is the “found badge” defense: a stolen or forgotten credential that wakes up gets a second look.
5Approving held actions (Human Queue)
When an action is Escalated, it is held and lands in the Human Queue. Nothing proceeds until a Platform Manager decides.
Review the held action — what was requested, by which agent, and why it was held.
Approve or Deny, entering your PM ID and a short reason. A reason is required for every decision.
Your decision is sealed to the permanent record — who decided, what they decided, why, and when. It cannot be erased or edited.
The decision is tied to you, not the screen. Because you enter your own PM ID, the record shows exactly which manager resolved it — not just “someone at the console.”
6Reading decisions & pulling receipts
The main console shows your most recent decisions in the Decision Ledger. Click any decision to expand its full flow — every stage it passed through, the outcome, the reason, and its identifying references.
Download a receipt. On any expanded decision, choose Download CSV or Download receipt (PDF) for a complete, sealed record of that action from start to finish — for compliance, an insurer, a warranty claim, or your own files.
Run a report. The Audit Reports page lets you filter decisions by date, outcome, or agent, and export the range.
7Managing your Platform Managers
The Platform Managers page is where you manage the people authorized to approve held actions and receive emergency alerts.
Add a manager with their name, a unique PM ID, and their email and mobile number. The email and mobile are how they are notified the instant an action needs a human.
Remove a manager when they no longer hold that responsibility. Only listed, active managers can approve held actions.
Keep contact details current. An emergency alert only reaches a manager if their email and mobile are right. Review the roster whenever your team changes.
8Emergency alerts
When an action is held for a human, the platform does two things at once so nothing waits unseen:
- It notifies your Platform Managers by email and text immediately — they do not have to be watching the console.
- It shows a red EMERGENCY banner at the top of the console, naming that an action needs a decision.
The banner clears when a manager resolves the held action in the Human Queue. There is no way to dismiss an emergency without a recorded decision behind it — the only way it goes away is a real approval or denial.
9Getting help
For questions about your deployment, your rules, or anything on this platform, contact your Nehemiah Layer representative at AlêBuca Global Connect, LLC — info@alebuca.com or (469) 919-7071.