Principle
Foundational values that guide governance, design, and operational decisions.
Role
Principles sit at the top of the definition stack. They state why the organisation cares, before guidance turns those values into observable expectations and controls turn them into safeguards. A principle does not tell you how to scan a pull request; it tells you that contribution must produce company benefit, that risk must be managed, or that AI systems must minimise unnecessary data exposure.
Examples
Contribute when there is company benefit
In an open source contribution programme, the Open Source Program Office (OSPO) records a principle that the company supports public contribution only when it advances business objectives and does not create unmanaged exposure. That value orients every later guideline about registration, approval and personal-versus-company activity.
Source: Contribute When There Is Company Benefit (company-benefit) in FOSS Contribution Principles.
Centralized Open Source Governance
The same programme states that the Open Source Program Office owns FOSS contribution strategy and governance. Downstream guidance and policy can then require inventory registration and approval without re-arguing who is accountable.
Source: Centralized OSPO Governance (ospo-governance) in FOSS Contribution Principles.
Proactive Data Sanitization
Filter and anonymise data before it enters an AI pipeline or external endpoint. Companion principles such as Least Exposure and Defense in Depth give AI mitigations a shared set of base values.
Source: Proactive Data Sanitization (AIR-PRIN-001) in FINOS-AIGF/AIR-PRIN.
Links upstream
- Organisational charters, ethics statements, OSPO mandates, AI governance frameworks
- Shared lexicon terms where wording must stay consistent
Links downstream
- Guidance guidelines cite the principles they uphold
Anti-patterns
Principles that are really controls
“Run a secret scan on every PR” is a control, not a principle. Principles should survive a change of tooling.
Orphan principles
A catalogue of values that no guideline, control or policy ever cites. If nothing downstream refers to them, they are decoration.