Core governance concepts

Organization, application and project#

A tenant is the organization boundary for access and configuration. An application identifies a particular integration and environment; its key, policy assignment and permitted route scope matter to execution. A project records purpose and accountable people, and may reference an application workload.

These objects answer different questions. Project ownership explains accountability. Application identity establishes which integration is calling. Neither a project name nor a declared responsibility creates an execution grant.

Intent, policy and authority#

Alignment is a versioned statement of governance intent across posture, boundary, authority, evidence, escalation, telemetry and change control. A policy pack supplies supported technical validators, weights and thresholds. Effective authority requires the relevant current identity, versions, lifecycle and review conditions.

An approved descriptive Alignment profile is not automatically executable. Where its conditions cannot be enforced, the current runtime holds the request. Approval, activation and successful enforcement must remain separate facts.

Findings, decisions and final outcomes#

A finding describes a rule match or issue. An engine decision expresses the policy response. A final enforcement outcome describes the handling of the actual artifact: RELEASED, TRANSFORMED, BLOCKED or HELD. A remediation instruction describes work required; it is not proof that the work occurred.

An input can be transformed before the provider is called while the final response is RELEASED. Reporting only the initial REDACTED decision would therefore misdescribe the final output. Inspect both ingress and final-boundary records.

Evidence and its strength#

A receipt links a result to a request, policy version and supported execution boundary. A digest checks identity of serialized content; it is not a signature, anonymization mechanism or independent endorsement. Source references and human attestations provide attribution, not proof that the cited statement is true.

• Demonstration: a teaching scenario, possibly simulated.
• Measured execution: a reproducible observed software result, with synthetic data labeled.
• Illustration: invented example values used to explain a design.
• Customer measurement: validated data from a defined customer baseline.