Security Governance

Is the exact running risk instance attributable to an approved canonical identity?

Did a currently valid authority delegate this approved purpose?

Is the requested activity inside the approved approved purpose and exclusions?

Is the assigned role valid for this risk, riskEnvironment, and task?

Are governing instructions complete, ordered, authentic, and unmodified?

Are all requested treatments registered at the exact approved versions?

Is every requested treatment necessary for the bounded approved purpose?

Are effective permissions no broader than the approved role and action?

Are credentials current, scoped, protected, and attributable?

Is every relied-upon retention item attributable, current, and permitted?

Is retention isolated from prohibited users, risks, tasks, and data classes?

May this risk create or direct each proposed treatment-plan?

Do sub-risks inherit all mandatory restrictions without authority expansion?

Are affectedDomain, channel, content, and disclosure all authorized?

Is projected and cumulative retention within every approved limit?

Is execution occurring only in the approved quality boundary?

Have no material dependencies changed since approval?

Has untrusted content remained subordinate to governing instructions?

Can the assigned human understand, interrupt, and review this action in time?

Is current telemetry available and are material alerts resolved?

Do open incidents or exceptions prohibit this action?

Has every material change been classified, tested, and approved?

Can the risk and all descendants be stopped without orphaned authority or state?

Can the action and result be preserved and compared with the approved approved purpose?