Organizational governance
Review administration and separation of duties
Understand explicit delegation, current reviewer eligibility and immutable policy decisions.
In this document
Delegate administration explicitly#
The new review-administration mechanism is implemented behind a default-off server flag. A platform administrator can bootstrap a time-bounded delegation to a different current member, with purpose and evidence. Delegated administration manages eligible reviewer assignments; it does not let a person approve on someone else's behalf.
Self-delegation, onward delegation and delegate self-appointment are not supported. Expiry, revocation or membership changes remove delegated authority while preserving its history.
Change the review policy through review#
An immutable review-policy version records the intended requirements and its content digest. The qualified contract requires four distinct legal, security, product and executive reviewers; the proposal author cannot supply one of those decisions. An authorized configuration manager activates an eligible version explicitly.
Reduced-review policies are not available. Describing a case as low risk, changing a posture or selecting an industry does not qualify it for fewer reviewers. A later policy change cannot rewrite the meaning of a historical sign-off.
Current authority differs from a past approval#
Eligibility includes current membership and assignment state. Durable membership epochs distinguish a continuously authorized reviewer from someone removed and later re-added. Returning to the same role does not silently revive old dependent authority.
Pinned decisions that depend on a disabled or changed administration mechanism hold rather than falling back to weaker rules. Existing legacy compatibility is deliberate and does not automatically backfill historical approvals with new pins.
Keep permission domains separate#
Project ownership, financial responsibility, administrative delegation and runtime review are different responsibilities. None should be used as a shortcut to acquire another. In a deployment review, identify who can propose, independently decide, activate, suspend and inspect each specific subject.
Prepare an immutable proposal, obtain independently assigned reviews, assess the exact version, and activate only through existing gates.
Current workflow; activation and runtime enforcement are separate checks.
Read the diagram description
Prepare an immutable proposal, obtain independently assigned reviews, assess the exact version, and activate only through existing gates. Current workflow; activation and runtime enforcement are separate checks.
Untrusted clients and content cannot grant authority. Server authorization, qualified adapters and scoped evidence each have separate responsibilities.
Architecture boundaries; no certification or complete customer-environment qualification claim.
Read the diagram description
Untrusted clients and content cannot grant authority. Server authorization, qualified adapters and scoped evidence each have separate responsibilities. Architecture boundaries; no certification or complete customer-environment qualification claim.