Policy & Controls Governance

Is the exact running dataset instance attributable to an approved canonical identity?

Did a currently valid authority delegate this approved purpose?

Is the requested activity inside the approved approved purpose and exclusions?

Is the assigned role valid for this dataset, processingEnvironment, and task?

Are governing instructions complete, ordered, authentic, and unmodified?

Are all requested sources registered at the exact approved versions?

Is every requested source necessary for the bounded approved purpose?

Are effective permissions no broader than the approved role and action?

Are credentials current, scoped, protected, and attributable?

Is every relied-upon retention item attributable, current, and permitted?

Is retention isolated from prohibited users, datasets, tasks, and data classes?

May this dataset create or direct each proposed transformation?

Do sub-datasets inherit all mandatory restrictions without authority expansion?

Are destination, channel, content, and disclosure all authorized?

Is projected and cumulative retention within every approved limit?

Is execution occurring only in the approved quality boundary?

Have no material dependencies changed since approval?

Has untrusted content remained subordinate to governing instructions?

Can the assigned human understand, interrupt, and review this action in time?

Is current telemetry available and are material alerts resolved?

Do open incidents or exceptions prohibit this action?

Has every material change been classified, tested, and approved?

Can the dataset and all descendants be stopped without orphaned authority or state?

Can the action and result be preserved and compared with the approved approved purpose?