[Feature] Add the horizontal obligation-risk-control-assurance graph #7

New Issue

2026-08-01T00:00:53+02:00

zemion commented

2026-08-01 00:00:53 +02:00

Outcome

Generalize the accepted sanctions-screening vertical into a reusable assurance model without weakening or rewriting its legal-review behavior.

Parent: GovOPlaN/govoplan#29

Model

Obligation -> governed object reference -> risk -> control -> evidence -> finding -> corrective measure -> effectiveness review

Every object/edge is effective-dated and records owner, scope, state, provenance, review evidence, and applicable policy/legal references.

Boundary

Risk Compliance owns risks, controls, findings, measures, and effectiveness review. Policy owns rule evaluation. Audit owns immutable event evidence. Files/Records own evidence content and retention. Tasks/Workflow coordinate action. The affected module owns the governed object and corrective execution.

Acceptance criteria

Versioned DTOs, persistence, migration, APIs, ACL, and search contributions cover the graph.
Opaque governed-object references prevent cross-module ORM imports.
One existing sanctions control and one non-sanctions synthetic control use the same assurance primitives.
Stale evidence, failed control, accepted risk, exception, remediation, and effectiveness states are explicit.
Reports expose aggregated assurance without leaking protected underlying objects.

## Outcome Generalize the accepted sanctions-screening vertical into a reusable assurance model without weakening or rewriting its legal-review behavior. Parent: https://git.add-ideas.de/GovOPlaN/govoplan/issues/29 ## Model `Obligation -> governed object reference -> risk -> control -> evidence -> finding -> corrective measure -> effectiveness review` Every object/edge is effective-dated and records owner, scope, state, provenance, review evidence, and applicable policy/legal references. ## Boundary Risk Compliance owns risks, controls, findings, measures, and effectiveness review. Policy owns rule evaluation. Audit owns immutable event evidence. Files/Records own evidence content and retention. Tasks/Workflow coordinate action. The affected module owns the governed object and corrective execution. ## Acceptance criteria - Versioned DTOs, persistence, migration, APIs, ACL, and search contributions cover the graph. - Opaque governed-object references prevent cross-module ORM imports. - One existing sanctions control and one non-sanctions synthetic control use the same assurance primitives. - Stale evidence, failed control, accepted risk, exception, remediation, and effectiveness states are explicit. - Reports expose aggregated assurance without leaking protected underlying objects.

zemion added the module/audit module/policy module/risk-compliance module/files module/workflow area/governance area/db module/tasks

labels 2026-08-01 00:00:53 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-01 00:00:54 +02:00

[Epic] Adopt the institutional governance target architecture #29

zemion referenced this issue

2026-08-01 00:01:55 +02:00

[Epic] Deliver reproducible sanctions and embargo screening with human review #2

zemion commented

2026-08-01 03:33:57 +02:00

Codex State: progress

Summary

Risk Compliance now truthfully declares its domain boundary, vertical-slice maturity, sanctions evidence, authority modes, ownership, and known horizontal-graph limitation in the module architecture metadata.

Verification

Risk Compliance backend suite: 9 passed; workspace manifest validation passed.

Next / Blocked

Implement the effective-dated assurance graph persistence/API/ACL/search model and prove one sanctions plus one non-sanctions control before closing.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Risk Compliance now truthfully declares its domain boundary, vertical-slice maturity, sanctions evidence, authority modes, ownership, and known horizontal-graph limitation in the module architecture metadata. ### Verification - `Risk Compliance backend suite: 9 passed; workspace manifest validation passed.` ### Next / Blocked - Implement the effective-dated assurance graph persistence/API/ACL/search model and prove one sanctions plus one non-sanctions control before closing. Suggested status label: `status/in-progress`

zemion added

and removed

labels 2026-08-01 03:35:43 +02:00

zemion commented

2026-08-01 08:20:25 +02:00

Codex State: done

Summary

Implemented the effective-dated, immutable-revision obligation-to-effectiveness assurance graph with optimistic concurrency and tenant ACLs.
Completed sanctions projection and a full non-sanctions control fixture on the same primitives; aggregate responses and search remain privacy-bounded.

Changed Files

src/govoplan_risk_compliance/backend/assurance.py
src/govoplan_risk_compliance/backend/db/models.py
src/govoplan_risk_compliance/backend/router.py
webui/src/features/riskCompliance/RiskCompliancePage.tsx
docs/RISK_COMPLIANCE_DOMAIN_BOUNDARY.md

Verification

15 Risk Compliance backend tests passed; Ruff and workspace TypeScript compile passed.

## Codex State: done ### Summary - Implemented the effective-dated, immutable-revision obligation-to-effectiveness assurance graph with optimistic concurrency and tenant ACLs. - Completed sanctions projection and a full non-sanctions control fixture on the same primitives; aggregate responses and search remain privacy-bounded. ### Changed Files - `src/govoplan_risk_compliance/backend/assurance.py` - `src/govoplan_risk_compliance/backend/db/models.py` - `src/govoplan_risk_compliance/backend/router.py` - `webui/src/features/riskCompliance/RiskCompliancePage.tsx` - `docs/RISK_COMPLIANCE_DOMAIN_BOUNDARY.md` ### Verification - `15 Risk Compliance backend tests passed; Ruff and workspace TypeScript compile passed.`

zemion closed this issue

2026-08-01 08:20:25 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-risk-compliance#7