Implement governed function assignment workflows

docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md

@@ -54,7 +54,7 @@ effective decision and provenance rather than IDM duplicating policy logic.
 
 ## IDM Aggregate
 
-IDM should persist one function-assignment change aggregate for both journeys:
+IDM persists one function-assignment change aggregate for both journeys:
 
 - change ID, tenant, kind (`request` or `grant`), function, unit, candidate
   identity/account, requested validity, and assignment source
@@ -67,9 +67,9 @@ IDM should persist one function-assignment change aggregate for both journeys:
 - idempotency key and optimistic-concurrency revision
 
 Candidate states are `draft`, `submitted`, `awaiting_holder`,
-`awaiting_authority`, `awaiting_recipient`, `approved`, `accepted`, `applied`,
-`rejected`, `withdrawn`, `expired`, `cancelled`, and `failed_manual_review`.
-Not every profile uses every state.
+`awaiting_authority`, `awaiting_recipient`, `changes_requested`, `blocked`,
+`approved`, `accepted`, `applied`, `rejected`, `withdrawn`, `expired`,
+`cancelled`, and `failed_manual_review`. Not every profile uses every state.
 
 The workflow instance coordinates the process, but the IDM change record is the
 business source of truth. A workflow callback applies the assignment exactly
@@ -97,6 +97,30 @@ reconciled without starting a second grant.
   functions or treated as an explicit emergency override with reason,
   provenance, and equivalent evidence.
 
+## Configuration And Runtime Contract
+
+Function settings use `assignment_governance`. Tenant defaults may be supplied
+through `settings.function_assignment_governance_defaults`; function values
+override only the corresponding defaults. Supported keys include
+`request_profile`, `grant_profile`, `authority_function_id`,
+`recipient_acceptance_required`, `evidence_required`,
+`separation_of_duties`, `quorum`, `maximum_validity_days`, and
+`request_expiry_hours`. Missing or malformed profiles fail closed.
+
+IDM exposes governed changes at
+`/api/v1/idm/function-assignment-changes`. Mutations require a strong `If-Match`
+precondition and the aggregate revision. Requests and grants pin the exact
+Workflow definition revision and hash, retain append-only transition evidence,
+support review change requests and responses, and apply an assignment exactly
+once. Vacant holder or authority functions create a visible `blocked` state;
+the lifecycle worker expires overdue open changes durably.
+
+Direct administration remains available for independently deployed IDM. When
+a function has an enabled governance profile, however, direct create or update
+requires `idm:function_change:admin` plus an emergency override reason. IDM
+stores the actor, time, reason, and evidence references with the assignment and
+includes them in the normal Audit change record.
+
 ## Module Boundaries
 
 - Organizations: function definitions and assignment-policy profile reference.