Set the policy before the workflow
Identify data owners, approved sources, access permissions, retention needs, and actions requiring human review. Give recommendations an explicit confidence and evidence standard.
- ✓ Source and permission register
- ✓ Approval and escalation matrix
- ✓ Policy exceptions and accountable owners
Preserve a decision record
Record the inputs, recommendation, reviewer, action, and version affected. Build review and rollback into the delivery process so governance operates during work rather than after an incident.
- ✓ Document the evidence and owner behind each decision.
- ✓ Agree acceptance criteria before implementation begins.
Scope and delivery decisions
This is operational governance design. Legal interpretation, regulatory certification, and compliance guarantees require appropriately qualified review.
- ✓ Confirm system access, dependencies, and data handling during discovery.
- ✓ Receive a scoped recommendation with responsibilities and verification steps.