Skip to main content

The Factors

These factors are designed to help anyone designing, implementing or reviewing governance for systems that run as services: platform engineers, security and risk practitioners, architects, and open-source maintainers who need portable, inspectable decisioning rather than tribal process.

  1. Govern Sensitive Activities

    Attach governance to the activities that create risk.

  2. Build a Governance Twin

    For every sensitive activity, maintain a Governance Twin that defines how it is governed alongside how it is implemented.

  3. Governance is Version Controlled

    Treat governance like code: versioned, reviewed, tested and promoted through environments.

  4. Govern the Factory and the Product Separately

    Govern how software is built separately from how the running product behaves—they are related but different sensitive activities.

  5. Context In, Decisions Out

    Governance decisions are explicit functions over context that returns a deterministic, inspectable decision result.

  6. Evidence by Default

    Every sensitive activity should emit evidence as a normal consequence of work—not as a special exercise for auditors.

  7. Continuous Governance

    Develop, test, promote and verify governance continuously alongside the systems it governs.

  8. Govern Dependencies

    Follow dependency relationships so governance decisions reflect the full supply chain of trust—not only the local activity.

  9. Governance Is Composable

    Compose governance from reusable, versioned artefacts rather than rewriting it for every product, project or organisation.

  10. Governance Has Owners

    Every governed activity needs accountability.