Policy Governance

Audience: Policy approvers, security leads, compliance owners, and operators responsible for sign-off and audit. Scope: Roles and Authority scopes, the approval workflow, signing/attestation, exception handling, and the audit trail for Stella Ops policies.

Imposed rule: Publish and promote actions require reason + ticket metadata and a DSSE attestation; two-person approval is recommended and enforced where configured by Authority.

This guide defines the roles, scopes, approvals, signing, and exception handling that govern Stella Ops policies. Pair it with the Policy System Overview for the big picture and the Policy Lifecycle & Approvals guide for the stage-by-stage workflow.

1. Roles & scopes

Author: policy:author, policy:simulate
Reviewer: policy:review, policy:simulate
Approver: policy:approve, policy:audit
Operator: policy:operate, policy:activate, policy:run
Publisher: policy:publish, policy:promote
Auditor: policy:audit

Authority can map organisational roles to scopes; the two-person rule can be enabled per tenant for publish/promote.

2. Approval workflow

Author drafts with shadow + coverage fixtures, then runs lint/simulate/test.
Submit with attachments (lint, simulate, coverage; reason/ticket optional at this stage).
Reviewers comment and resolve; the approver checks gates (shadow, coverage, determinism).
Publisher runs stella policy publish --reason --ticket --sign; the attestation is stored and optionally mirrored to Rekor.
Operator activates the version; audit events are recorded.

3. Signing & attestation

DSSE payload includes IR hash, policyId/version, reason, ticket, approvals, shadow/coverage evidence refs.
Rekor mirror when online; offline deployments store bundle + checkpoint for later replay.
Evidence Locker stores DSSE + run inputs/outputs for audit.

4. Exceptions & waivers

Use SPL rules with explicit scope and because rationale; no perpetual suppressions.
Waivers must include expiration and owner; DSSE attested if exported.
AOC: Aggregation-Only Contract requires waiver scope to avoid cross-tenant data; UI/CLI enforce tenant scoping.

5. Compliance checklist

[ ] Two-person rule enforced (Authority config) for publish/promote.
[ ] Reason and ticket captured on publish; stored in attestation metadata.
[ ] Shadow + coverage gates passed and attached.
[ ] IR hash recorded; attestation verified before activation.
[ ] Waivers have expiry, owner, because, and scope.
[ ] Offline replay path documented for the policy pack.

6. Audit & observability

Timeline events: policy.submitted, policy.approved, policy.published, policy.promoted, policy.activated, policy.archived.
Metrics: policy_publish_total, policy_promote_total, policy_attestation_verify_failures, policy_shadow_runs_total.
Logs: include policyId, version, attestation_ref, reason, ticket, shadow.