INVARIANCE | Arc
MenuClose
Arc II · Governance

Preserve the authority behind the result.

One authority determination evaluates each proposed result against the organization’s requirements. Governance reads that determination as accountability: who acted, under what authority, with what determination, and what followed, preserved as organizational memory. Arc I reads the same determination as control →

One shared boundary

How governance uses the authority determination.

Proposed resultA payment, release, disclosure, deployment, change, or automated action.
Authority evaluationThe organization’s requirements, applied under the current operating condition.
Permit · Defer · BlockThe determination, before the result takes effect.
Durable authority recordThe result, actor, basis, conditions, and determination.

Governance teams use the record to identify the proposed result, its initiator, the applicable authority, and the determination. How the evaluation works →

From policy to determination

Organizational policy becomes an operational determination.

Policies, delegations, signing schedules, and other approved sources establish authority. Authority Control applies that established authority to consequential results before they take effect.

Authority requirements

Who or what may create selected consequential results, and under what organizational approvals.

Documented sources

The organizational policies, delegations, and approvals relevant to the determination.

Review requirements

What the organization requires before selected consequential results may take effect.

Limits and conditions

The organizational limits and conditions that apply to the selected result.

Four outputs

What governance receives from the determination.

Attribution

Identify the proposed result and the person or system that initiated it.

Accountability

Review the authority basis and the accountable source recorded for the determination.

Authority trail

Follow the proposed result through its applicable requirements, determination, and durable record. Defer and Block are recorded as well as Permit.

Organizational memory

Records accumulate into evidence the organization can review across workflows and connected relationships.

The three concepts stay distinct. Attribution identifies the result and its initiator. Accountability identifies the authority and its owner. The authority trail is the path the organization can follow between them.

Governed exceptions

Exceptions and posture changes stay accountable.

Defer

Defer applies when Permit still requires additional authority, evidence, or review before the result can proceed.

Explicit confirmation

Selected classes require explicit confirmation before the result takes effect, recorded in the trail.

Degraded trust

When trust degrades, selected consequential results may face tighter conditions. Post-Breach →

Recovery

Normal operating conditions can return through accountable organizational decisions.

Decision findability

Find and understand the decisions that bind the enterprise.

A durable authority record makes each determination available for review.

Find the decision

Locate the authority record associated with a governed result.

Understand the basis

Review the authority requirements, evidence, conditions, and limits that applied.

Distinguish the decision from execution

Compare the authority determination with execution evidence where that evidence is available.

Review recurring issues

Use authority records to identify where organizational requirements may need review.

Qualification

The determination record covers activity evaluated by Authority Control. Later reconstruction from other evidence is a separate analysis.

Design partners

Accountability, at the point of decision.

The record preserves the proposed result, its initiator, the applicable authority, and the determination. What happened afterward requires execution evidence.

Discuss one consequential workflow