Policy Governance

Audience: Policy approvers, security leads, compliance owners, and operators responsible for sign-off and audit. Scope: Roles and Authority scopes, the approval workflow, signing/attestation, exception handling, and the audit trail for Stella Ops policies.

Governance requirement: Publish/promote still require reason, ticket and trusted DSSE evidence. The current Engine pack API does not implement Registry review/publication; its metadata and activation checks do not waive these requirements. Lifecycle source verified: 05534daa6eb60609d9b716f7a7c1db38adb74551 (2026-08-31), PolicyPackEndpoints, PostgresPolicyPackRepository, PolicyActivationSettings and PolicyBundleService. Re-verify with the lifecycle source commands; no live approval is claimed.

This guide defines the roles, scopes, approvals, signing, and exception handling that govern Stella Ops policies. Pair it with the Policy System Overview for the big picture and the Policy Lifecycle & Approvals guide for the stage-by-stage workflow.

1. Registered lifecycle scopes

Metadata and bundle operations: policy:edit.
Pack listing, explicit revision evaluation and capability discovery: policy:read.
Activation: policy:activate.

Authority supplies the scoped tenant identity. PolicyEngine:Activation resolves the persisted two-person requirement when revision metadata is created. The Engine’s distinct activation actor check is not an author-versus-reviewer separation rule. Preserve organizational separation; the existence of review/publish scope names does not register the corresponding workflow.

2. Available workflow and required review

Create explicit Draft metadata, then compile/store the reviewed source bundle.
Obtain real lint/coverage, shadow and determinism evidence, reviewer sign-off and resolution of blocking comments through the approved procedure. These requirements remain; Registry attachment/reviewer automation is unavailable.
Only after those prerequisites are met, explicitly upsert Approved metadata using policy:edit.
Request activation with policy:activate and the persisted actor threshold. HTTP 202 is pending, not active.
Verify exact consumer selection and forcing separately; activation does not publish or schedule a run.

The future Registry submit/review/publish workflow is a design requirement, not the Engine’s implemented approval path. If required governance evidence is unavailable, hold the governed operation; never substitute the Approved flag or fabricated shadow results.

3. Signing & attestation requirements

Governed publication must bind the policy/revision and reviewed digest to reason, ticket, actual approval and shadow/coverage evidence, with trusted signing and the required custody/replay records.
PolicyBundleService.Sign currently emits a deterministic offline-testing signature stub, not a DSSE envelope or operator signature. Its compilation metadata has no attestation reference.
Do not equate compilation metadata, is_published status or a separate verdict attestation with signed policy approval/publication. Verify an actual supported signing/export path before crediting it.

4. Exceptions & waivers

Use SPL rules with explicit scope and because rationale; no perpetual suppressions.
Waivers must include expiration and owner; DSSE attested if exported.
AOC: Aggregation-Only Contract requires waiver scope to avoid cross-tenant data; UI/CLI enforce tenant scoping.

5. Compliance checklist

[ ] Persisted activation requirement verified; real reviewer separation and any publication quorum satisfied independently.
[ ] Reason and ticket captured on publish; stored in attestation metadata.
[ ] Shadow + coverage gates passed and attached.
[ ] IR hash recorded; attestation verified before activation.
[ ] Waivers have expiry, owner, because, and scope.
[ ] Offline replay path documented for the policy pack.

6. Audit & observability

The durable Engine path retains pack/revision state and activation-actor records in Policy-owned tables; its endpoint audit metadata covers pack creation, revision metadata and activation.
PolicyActivationAuditor records actual activation-attempt fields when configured. Retain responses, digests and independent governing evidence.
Registry submission/review/publish/archive events and their dashboard metrics are future workflow requirements, not evidence emitted by this pack path. Do not populate a missing review trail with synthetic events.