Governance & Disclosure Model

1. Overview

Govula implements a multi-framework compliance platform with strict governance controls to ensure controlled disclosure and audit-safe operation. The platform supports multiple compliance frameworks internally while maintaining a single authoritative view per stakeholder group.

2. Core Governance Principles

2.1 Framework Enablement

Compliance frameworks (ISO 27001, SOC 2, NIST CSF, HIPAA, PCI DSS, etc.) are data-layer entities that are never directly exposed to external stakeholders. Each framework may be enabled or disabled by administrators without affecting the visibility of other frameworks.

2.2 Workspace Isolation

Each enabled framework creates a dedicated workspace. Workspaces are the unit of disclosure, not frameworks. A workspace contains:

• Statement of Applicability (SoA) specific to that framework
• Control justifications and evidence
• Framework-specific audit narratives
• Compliance snapshots and reports

Workspaces progress through defined lifecycle states:

1. DRAFT — Initial preparation state
2. IN PROGRESS — Active control population and evidence gathering
3. READY FOR DISCLOSURE — Pre-authorisation review state
4. AUTHORISED — Approved for audience binding

Only workspaces in the AUTHORISED state may be bound to external stakeholder audiences.

2.3 Audience Binding

The platform defines four stakeholder audiences with distinct access requirements:

Each non-technical audience is explicitly bound to exactly one authorised workspace. This binding is immutable once locked and serves as an audit artefact.

3. Disclosure Control Mechanisms

3.1 Report Generation

All reports, SoA documents, and data exports are generated exclusively from the workspace bound to the requesting user's audience. Reports do not accept framework or workspace parameters; the workspace is resolved automatically based on the authenticated user's role.

1. Identify requesting user
2. Resolve user to audience mapping
3. Resolve audience to bound workspace
4. Generate report from bound workspace only

3.2 Access Enforcement

The platform enforces workspace access at the API level, not merely at the UI level. Any attempt by a non-technical user to access a workspace other than their bound workspace results in an HTTP 403 Forbidden response.

3.3 Cross-Framework Isolation

Each workspace maintains its own:

• Statement of Applicability (SoA)
• Control justifications
• Evidence mappings
• Audit narratives

While internal cross-framework control mappings may exist for evidence reuse purposes, these mappings are never exposed to auditors or management stakeholders and cannot influence the content of bound workspace reports.

4. Audit Trail

All workspace binding operations are logged to an immutable audit trail, including:

• Binding creation and modification
• Binding lock operations
• Administrator who performed the action
• Timestamp of the operation

This audit log is available to administrators and auditors for compliance verification.

5. Design Guarantees

The Govula governance model provides the following guarantees: