Vendor & Third-Party Governance

Is the exact running vendorRisk instance attributable to an approved canonical vendor identity?

Did a currently valid authority delegate this approved purpose?

Is the requested activity inside the approved approved purpose and exclusions?

Is the assigned role valid for this vendorRisk, relationshipEnvironment, and task?

Are governing instructions complete, ordered, authentic, and unmodified?

Are all requested obligations registered at the exact approved versions?

Is every requested obligation necessary for the bounded approved purpose?

Are effective permissions no broader than the approved role and action?

Are vendor credentials current, scoped, protected, and attributable?

Is every relied-upon retention item attributable, current, and permitted?

Is retention isolated from prohibited users, vendors, tasks, and data classes?

May this vendorRisk create or direct each proposed obligation-plan?

Do sub-vendors inherit all mandatory restrictions without authority expansion?

Are serviceDomain, channel, content, and disclosure all authorized?

Is projected and cumulative retention within every approved limit?

Is execution occurring only in the approved quality boundary?

Have no material dependencies changed since approval?

Has untrusted content remained subordinate to governing instructions?

Can the assigned human understand, interrupt, and review this action in time?

Is current telemetry available and are material alerts resolved?

Do open incidents or exceptions prohibit this action?

Has every material change been classified, tested, and approved?

Can the vendorRisk and all descendants be stopped without orphaned authority or state?

Can the action and result be preserved and compared with the approved approved purpose?