Change authority
Deploys, rollback exits, and other production-impacting changes need an explicit approval record, a target surface, and an operator owner before they move.
Freeze rules
Emergency and change-freeze windows override normal release motion. Diagnostic review stays visible, but risk-adding actions should wait for the freeze to clear.
Audit posture
Every meaningful operator action should leave evidence in governance logs, audit exports, runbooks, or handoff notes so later review is fast and credible.
Decision lanes
Routine operator review
ObserveDashboards, audits, exports, and drift inspection. These surfaces stay additive and observational.
Governed release motion
ApproveDeploy promotion, rollback preparation, approval expiry management, and freeze exit sequencing.
Emergency response
StabiliseIncidents, emergency freezes, and recovery actions. Speed matters, but the log still needs to capture why the move happened.
Operator evidence sources
Governance log
Open logApprovals, freeze events, deploy decisions, rollback notes, and operator sign-off state.
Approval expiry board
Open boardPending and expiring approvals, freeze windows, and stale acknowledgements in one board.
Audit export
Export evidenceBundle the evidence trail for review, handoff, or compliance follow-up without changing live state.
Surface-by-surface governance expectations
| Surface | Operator expectation | Primary follow-up |
|---|---|---|
| Deploy / rollback | Confirm approval, verify smoke-test evidence, and record expiry or rollback scope before alias motion. | Deployment Diff · Rollback Wizard |
| Freeze windows | Respect active freeze windows, keep a reason + end time visible, and route urgent work through the emergency lane only when justified. | Emergency Freeze |
| Operator access | Review who requested elevated action, which surface is affected, and whether the approval or review state is still fresh. | Access Requests |
| Shift handoff | Leave the next operator with the current risk picture, active incidents, and any approvals or freezes about to expire. | On-Call Handoff |