Governance — storage¶
Generated from the architecture model
This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.
Store engines are profile statements (ADR-0006 NHibernate, ADR-0013 vector profiles, ADR-0012 transports). Residency and backup follow the data governance decision (D31) and the NFR baseline (D30).
| Service | Store | Role | Engine / profile | Tables | Residency | RPO / RTO (min) |
|---|---|---|---|---|---|---|
| ApprovalPolicyService | Governance store | primary | azure-sql / nhibernate-sqlserver | ApprovalRules, RoutingEvaluations | tenant-region | 15 / 240 |
| AuditService | Governance store | primary | azure-sql / nhibernate-sqlserver | AuditEntries, ChainHeads, Classifications, RedactionRules, Findings | tenant-region | 15 / 240 |
| AuditService | Immutable audit store | blob | blob / azure-blob-immutable | — | tenant-region | 15 / 240 |
| GovernanceHost | Governance store | primary | azure-sql / nhibernate-sqlserver | — | tenant-region | 15 / 240 |
| GovernanceHost | Immutable audit store | blob | blob / azure-blob-immutable | — | tenant-region | 15 / 240 |
| GovernanceHost | Secret store | primary | key-vault / azure-key-vault | — | tenant-region | 0 / 60 |
| GovernanceHost | Cache and coordination | cache | redis / azure-cache | — | tenant-region | 0 / 30 |
| PolicyEngineService | Governance store | primary | azure-sql / nhibernate-sqlserver | PolicyBundles, PolicyRules, PolicyDecisions | tenant-region | 15 / 240 |
| PolicyEngineService | Immutable audit store | blob | blob / azure-blob-immutable | — | tenant-region | 15 / 240 |
| PolicyEngineService | Cache and coordination | cache | redis / azure-cache | — | tenant-region | 0 / 30 |
| SecretBrokerService | Governance store | primary | azure-sql / nhibernate-sqlserver | SecretReferences, RotationReceipts, Issuances | tenant-region | 15 / 240 |
| SecretBrokerService | Secret store | primary | key-vault / azure-key-vault | — | tenant-region | 0 / 60 |
Stores owned by this platform's hosts¶
| Store | Engine | Profile | Owner | Summary |
|---|---|---|---|---|
| Governance store | azure-sql | nhibernate-sqlserver | GovernanceHost | Policies, decisions, approval policy, audit evidence, classification. |
| Immutable audit store | blob | azure-blob-immutable | GovernanceHost | Append-only audit evidence retained 7 years, redacted (D31). |
| Secret store | key-vault | azure-key-vault | SecretBrokerService | Secrets referenced, never copied into manifests or prompts. |