Skip to content

Governance — Workflows

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P7)

The June-2026 page is archived under catalogs 2026-06.

Policy bundle activation

A policy bundle is a Published asset (BC-04). On AssetReleasePublished the engine validates tightening against the parent scope (every rule of the child is equal or stricter), activates the revision for its scope and emits PolicyRevisionActivated; new runs pin it, accepted runs keep theirs. A bundle that loosens is refused with the offending rules, and the previous revision stays active. Approval rules are part of the bundle and load into ApprovalPolicyService.

Decision

flowchart LR
    Q["Caller: subject, domain, action, class, resource, environment"] --> R["Resolve chain<br/>platform → tenant → project"]
    R --> M["Match rules by priority"]
    M --> E{"Effect"}
    E -- Allow --> X["Proceed, obligations attached"]
    E -- RequireApproval --> A["Approval of the action class bound to the decision"]
    E -- Deny --> D["Refused with reasons"]
    E -- Prohibited --> P["Refused; no approval can override"]
    X & A & D & P --> V["Decision recorded, evidence appended"]
Hold "Alt" / "Option" to enable pan & zoom

The environment class raises action classes before matching; Frozen environments deny writes at the Control plane before policy is asked.

Approval routing and validation

Run Control calls Route when it creates an approval request (eligible approvers, expiry per rule) and ValidateDecision when someone decides (eligible now, not the requester, not the author, unexpired, quorum). Break-glass by a Platform admin requires the rule to allow it and a reason, and is always evidence. Membership and delegation changes invalidate cached eligibility.

Evidence

Every consumed event becomes an entry in tenant sequence with the previous entry's hash; entries are mirrored to the immutable store; the chain head is signed daily; the verifier recomputes the chain and raises a Critical finding on a break. Commands that are not events (exports, classification changes) append through Record.

Classification and redaction

Platform admins set labels per resource type or instance (data class, retention, redaction rules, residency); ClassificationChanged reaches context assembly, artifacts, ingestion and the model gateway, which apply it from the next operation; the retention sweeper enforces it across stores through lifecycle tasks and redacts personal identifiers in evidence past the window.

Secret issuance

sequenceDiagram
    participant C as Caller
    participant B as SecretBrokerService
    participant P as PolicyEngineService
    participant KV as Key Vault
    C->>B: Issue (reference, subject, purpose, scope, TTL)
    B->>P: Decide
    B->>KV: resolve or exchange
    B-->>C: credential once, expiry
    Note over B: CredentialIssued (metadata)
    C->>B: Revoke on lease end
    B->>B: ExpirySweeper revokes the rest
Hold "Alt" / "Option" to enable pan & zoom

Rotation records a new vault version and revokes live issuances of the old one; revocation of a reference stops every owner (connections, deployments, pools) through events.

Findings and exports

Findings arise from evidence (chain break, prohibited attempts, unresolved uncertain effects after 24 h, overdue rotation) with severity and owner; resolution is evidence. A tenant exports a project's evidence with chain proofs in open formats (XL-14); the export is itself evidence.