Governance — bounded contexts

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.

flowchart LR
    subgraph governance["Governance"]
        BC_18["BC-18<br/>Policy"]
        BC_19["BC-19<br/>Audit"]
        BC_20["BC-20<br/>Approval Policy"]
        BC_40["BC-40<br/>Secret Broker"]
    end

Hold "Alt" / "Option" to enable pan & zoom

Context	Authoritative state	Services	Status
BC-18 Policy	Policy definitions and recorded decisions	6	target
BC-19 Audit	Audit evidence, findings, classification, reports	7	target
BC-20 Approval Policy	Routing, separation of duties, expiry rules (instances are BC-03)	1	target
BC-40 Secret Broker	Short-lived credential issuance, secret references, rotation and revocation receipts	1	target

BC-18 Policy

Authoritative state: Policy definitions and recorded decisions | Service | Granularity | Host | Status | |---|---|---|---| | GovernanceHost | standalone host | — | target | | MemoryPolicyService | module of host | GovernanceHost | unmodelled | | PolicyDefinitionService | module of host | GovernanceHost | unmodelled | | PolicyEngineService | module of host | GovernanceHost | target | | PolicyEvaluationService | module of host | GovernanceHost | unmodelled | | TenantIsolationPolicyService | module of host | GovernanceHost | unmodelled |

Events produced: PolicyRevisionActivated, PolicyRevisionRetired, PolicyDecisionRecorded

BC-19 Audit

Authoritative state: Audit evidence, findings, classification, reports | Service | Granularity | Host | Status | |---|---|---|---| | AuditService | module of host | GovernanceHost | target | | ComplianceReportService | later stage | — | unmodelled | | DataClassificationService | module of host | GovernanceHost | unmodelled | | MemoryClassificationService | module of host | GovernanceHost | unmodelled | | MemoryRedactionService | module of host | GovernanceHost | unmodelled | | RiskScoringService | later stage | — | unmodelled | | SecurityFindingService | later stage | — | unmodelled |

Events produced: AuditEntryRecorded, AuditChainVerified, ClassificationChanged, FindingRaised, FindingResolved

BC-20 Approval Policy

Authoritative state: Routing, separation of duties, expiry rules (instances are BC-03) · Decisions: ADR-0015 | Service | Granularity | Host | Status | |---|---|---|---| | ApprovalPolicyService | module of host | GovernanceHost | target |

Events produced: ApprovalRuleActivated, ApprovalRouted, ApprovalDecisionValidated

BC-40 Secret Broker

Authoritative state: Short-lived credential issuance, secret references, rotation and revocation receipts | Service | Granularity | Host | Status | |---|---|---|---| | SecretBrokerService | module of host | GovernanceHost | target |

Events produced: SecretReferenceRegistered, SecretRotated, SecretReferenceRevoked, CredentialIssued, CredentialRevoked