Skip to content

Governance — Deployment

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P7)

The June-2026 page is archived under catalogs 2026-06.

Runtime model

Concern Choice
Deployment unit GovernanceHost, one image from the microservice template; four modules
Hosting AKS, 3 to 10 replicas across availability zones; pod disruption budget of two
Data governance-sql (bundles, decisions, rules, routing, evidence, classifications, findings, references, issuances); audit-immutable (write-once blob mirror); secrets (Key Vault, HSM-backed keys); cache
Messaging MessagingModel outbox and inbox; Orleans profile
Identity workload identity; all callers present workload or delegated tokens
Ingress gRPC from every host; GW-03 for Studio reads and administration; no public surface
Egress Key Vault, Identity Platform, Control plane, Config Platform

Topology by profile

Profile Placement
saas-default ConnectSoft AKS in the tenant's region; immutable store in the same region
hybrid ConnectSoft cloud; in-network hosts call it over a private link; break-glass if the link fails is not possible by design (fail closed)
on-prem customer cluster with the customer's Key Vault equivalent and an immutable store
hybrid-compute as saas-default 
flowchart LR
    subgraph Region["Tenant region, three zones"]
        G1["GovernanceHost"]
        G2["GovernanceHost"]
        G3["GovernanceHost"]
        SQL["('governance-sql, zone-redundant')"]
        IMM["('audit-immutable')"]
        KV["Key Vault (HSM)"]
    end
    G1 & G2 & G3 --> SQL & IMM & KV
Hold "Alt" / "Option" to enable pan & zoom

Scaling

Signal Action
decision latency above 50 ms p95 add replicas; decision cache per revision
evidence lag writer partitions per tenant
issuance latency Key Vault throughput; token exchange caching within TTL

Configuration and secrets

Options sections Governance:Host, Governance:Policy, Governance:Approvals, Governance:Audit, Governance:Classification, Governance:Secrets. Store, chain-signing and vault-access secrets in Key Vault through workload identity; FailClosed is not reloadable.

Health and rollout

Readiness requires every dependency; rolling updates keep two replicas serving; bundle activations are additive data, never deployments.

NFR class and recovery

pilot-interactive with a 99.9 % availability objective. Restore order (D30): the run journal first, then approvals, which live here as routing evaluations and in Run Control as instances; governance-sql is restored before the runtime and knowledge stores because every caller needs it; the chain is re-verified against the immutable mirror after a restore.