Governance — data model

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.

ApprovalPolicyService

erDiagram
    ApprovalRule {
        string ruleId PK
        string tenantId
        string scope
        string actionClass
        string actionPattern
        list_string approverRoles
        bool excludeRequester
        bool excludeAuthor
        int quorum
        int expiryMinutes
        bool breakGlassAllowed
        string policyRevision
        bool active
    }
    RoutingEvaluation {
        guid evaluationId PK
        string tenantId
        guid approvalId
        guid runId
        string ruleId
        string actionClass
        string requesterId
        string authorId
        list_string eligibleApprovers
        string deciderId
        enum_RoutingOutcome outcome
        bool breakGlass
        datetime expiresAt
        datetime evaluatedAt
    }

Hold "Alt" / "Option" to enable pan & zoom

Tables: dbo.ApprovalRules, dbo.RoutingEvaluations — see the DDL appendix.

AuditService

erDiagram
    AuditEntry {
        guid entryId PK
        string tenantId
        string projectId
        long sequence
        enum_EvidenceKind kind
        json actor
        string action
        json target
        string reason
        string outcome
        guid correlationId
        guid causationId
        guid runId
        string sourceEvent
        hash previousHash
        hash entryHash
        datetime recordedAt
    }
    ClassificationLabel {
        guid labelId PK
        string tenantId
        string resourceType
        string resourceId
        enum_DataClass dataClass
        int retentionDays
        list_string redactionRuleIds
        string residency
        string setBy
        datetime setAt
    }
    Finding {
        guid findingId PK
        string tenantId
        enum_FindingSeverity severity
        string category
        list_guid evidenceEntryIds
        string owner
        string state
        datetime raisedAt
        datetime resolvedAt
    }
    RedactionRule {
        string ruleId

        string detector

        string action

        list_string appliesTo

    }
    ClassificationLabel ||--o{ RedactionRule : contains

Hold "Alt" / "Option" to enable pan & zoom

RedactionRule (entity)

A redaction pattern or detector bound to a data class (ConnectSoft.Extensions.Compliance).

Field	Type	Required	Description
ruleId	string	yes
detector	string	yes	regex
action	string	yes	mask
appliesTo	list:string	yes	prompt

Tables: dbo.AuditEntries, dbo.ChainHeads, dbo.Classifications, dbo.RedactionRules, dbo.Findings — see the DDL appendix.

PolicyEngineService

erDiagram
    PolicyBundle {
        string revision PK
        string tenantId
        enum_PolicyScope scope
        string scopeId
        string releaseId
        string parentRevision
        string rulesRef
        hash rulesHash
        list_string domains
        bool active
        datetime activatedAt
    }
    PolicyDecision {
        guid decisionId PK
        string tenantId
        string projectId
        string environmentId
        guid runId
        json subject
        enum_PolicyDomain domain
        string action
        string actionClass
        json resource
        hash inputsHash
        string policyRevision
        enum_PolicyEffect effect
        json obligations
        list_string matchedRules
        list_string reasons
        datetime evaluatedAt
    }
    PolicyRule {
        string ruleId

        enum_PolicyDomain domain

        json match

        enum_PolicyEffect effect

        json obligations

        int priority

    }
    PolicyBundle ||--o{ PolicyRule : contains

Hold "Alt" / "Option" to enable pan & zoom

PolicyRule (entity)

One typed rule of a domain.

Field	Type	Required	Description
ruleId	string	yes
domain	enum:PolicyDomain	yes
match	json	yes	Subject, action, resource and environment predicates
effect	enum:PolicyEffect	yes
obligations	json	no
priority	int	yes

Tables: dbo.PolicyBundles, dbo.PolicyRules, dbo.PolicyDecisions — see the DDL appendix.

SecretBrokerService

erDiagram
    SecretReference {
        string referenceId PK
        string tenantId
        enum_SecretKind kind
        string vaultRef
        string ownerKind
        string ownerId
        list_string allowedPurposes
        int maxTtlSeconds
        int rotationDays
        datetime lastRotatedAt
        bool revoked
    }
    Issuance {
        guid issuanceId PK
        string tenantId
        string referenceId
        json subject
        string purpose
        json scope
        guid policyDecisionId
        enum_IssuanceState state
        datetime issuedAt
        datetime expiresAt
        datetime revokedAt
    }

Hold "Alt" / "Option" to enable pan & zoom

Tables: dbo.SecretReferences, dbo.RotationReceipts, dbo.Issuances — see the DDL appendix.