Governance — Observability¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Spans¶
Decision, routing, issuance and classification calls are child spans of the caller's span with policy.revision, policy.decision.id, policy.effect, approval.id, issuance.id and the module; evidence writes are spans keyed on tenant and sequence. No rule text, content or secret material on spans.
Metrics¶
| Metric | Why it matters |
|---|---|
connectsoft.factory.governance.host.decision_latency |
on the hot path of every run and call |
connectsoft.factory.policy.decisions by effect |
denials, prohibited attempts, approval demand |
connectsoft.factory.policy.tightening_rejections |
overrides refused |
connectsoft.factory.approval_policy.routings by outcome, invalid_decisions, break_glass |
approval hygiene |
connectsoft.factory.audit.chain_lag, chain_valid, entries |
evidence timeliness and integrity |
connectsoft.factory.audit.findings_open by severity |
what needs attention |
connectsoft.factory.secrets.issue_latency, issuances by outcome, live_issuances, rotation_due |
credential hygiene |
Logs¶
Structured, keyed on decision, approval, entry and issuance ids; never rule bodies, payloads or secret values.
Health¶
/governance/health reports the governance store, the immutable store, Key Vault and the identity platform; readiness fails when any of them is unreachable, because the host must fail closed rather than answer from stale state.
Objectives (pilot class, D30)¶
| Objective | Target |
|---|---|
| Decision latency | p95 under 50 ms |
| Issuance latency | p95 under 200 ms |
| Evidence lag | p95 under 30 s from event to chain |
| Chain verification | daily, 100 % valid |
| Availability | 99.9 % monthly (above the platform's 99.5 % because everything depends on it) |
Dashboards and alerts¶
Dashboards: decisions by domain and effect, prohibited attempts by subject, approval routing outcomes and break-glass, evidence lag and chain validity, findings by severity, issuances and rotations. Alerts: decision latency, chain invalid, evidence lag, prohibited-attempt spikes, break-glass use, rotation overdue, Key Vault errors.