Governance
The governance module holds your governing documents — policies, standards, procedures and guidelines — and the evidence that they were authorised, published, read, and mapped to the frameworks you are assessed against.
The one idea to take away
A policy is not a file. It is a document with a lifecycle: every change creates a new version, the version is approved by named people, publication is an event with a date, and the people it binds confirm they have read that version. Nothing in the module lets you skip a step in that chain, because the chain is the evidence.
The second idea follows from the first: AI drafts, humans ratify. The agents in this module never write a policy, a mapping or a version into the record. They raise a proposal, and a person accepts it.
Where things live
| Where | What it holds |
|---|---|
| Policy library | Every governing document, filtered and searchable. |
| Document lifecycle | Draft → in review → approved → published → effective → retired. |
| Document content | The body of the document, in English and Arabic. |
| Versions, reviewers and approvals | Version history, the named reviewers, and the approval gate. |
| My Reviews | What is waiting on your approval. |
| Attestation | Campaigns asking people to acknowledge a document. |
| Exceptions | Time-boxed, justified departures from a policy. |
| Control mappings | What framework and risk controls a document governs. |
| Coverage and AI | Which framework domains have no governing document. |
| AI proposals | Everything an agent suggests, each gated by a human decision. |
| Dashboard | Lifecycle counts, attestation rate, reviews falling due. |
| Roles and permissions | Who can do what in this module. |
How this connects to the rest of the platform
A policy is what you told people to do. A compliance assessment checks whether it happens. An audit tests it independently. A risk control is the thing the policy mandates.
Coverage is the seam between them. A framework domain with no governing document behind it will keep producing findings in every assessment and every audit until somebody writes the document. Coverage is how you find those domains before an assessor does.
The database carries tables for committees, meetings, minutes, decisions and a governance calendar, but no screens use them yet. They are not part of the module you can operate today and are not documented here.