Governance — Later capabilities¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Later-stage registry rows¶
| Row | Purpose | Trigger |
|---|---|---|
ComplianceReportService |
periodic compliance reports from evidence per framework | tenant audit demand |
RiskScoringService |
risk scores per run, project and tenant from decisions, findings and uncertain effects | evidence volume |
SecurityFindingService |
findings from scanners (dependencies, images, generated code) joined with evidence | delivery pipeline integration |
Platform-wide¶
| Capability | Purpose | Trigger | Owner |
|---|---|---|---|
| Policy simulation at depth (what-if against months of decisions) | predict the impact of a change before activation | decision history available | BC-18 |
| Policy drift detection across tenants and projects | find overrides that diverge from platform intent | multi-tenant pilot | BC-18 |
| Agent-authored policy proposals reviewed by Platform admins | governance analyst agent (former roadmap) | Software Factory pack | BC-18 with the pack |
| Quorum and SLA approvals with escalation; on-call routing | approval operations | approval volume | BC-20 |
| Evidence attestations and signed exports for customers' auditors | external assurance | first regulated tenant | BC-19 |
| Token exchange everywhere (no stored keys) | custody without secrets | provider support | BC-40 |
| Secret-expiry forecasting | hygiene | rotation history | BC-40 with BC-16 |
| Data residency enforcement per tenant (ResidencySilo) | region constraints on every store and provider | canonical ADR-0100 silo mode in use | BC-19 with BC-33 |