Security governance pack (packs:security-governance)

packs:security-governance

The security-governance pack is the compliance administration layer over machinery the base platform already runs: mandated-notification administration and its delivery-evidence trail, the evidence ledger's auditor surfaces, the access-review campaign kind, step-up by policy and the auditor security role. One posture runs through every gate — the controls are free, the admin surfaces are the pack: enforcement of what is already configured never consults the licence, so a lapsed entitlement freezes administration without dropping the organisation's guaranteed coverage. The licensing machinery itself is entitlements; the governance objects these surfaces administer are the governance foundation; the per-RPC determination × pack × step-up table is opschain docs governance-matrix.

What the entitlement gates

Every surface below answers the typed refusal without the pack: permission_denied with ERROR_REASON_PACK_ENTITLEMENT_REQUIRED, naming the feature and the tier — this surface requires the "packs:security-governance" entitlement - the <tier> licence does not include it; apply the licence pack that grants it (opschain admin licence apply).

• Notification governance admin (NotificationAdminService, admin plane + the pack): mandate create/update/delete and the admin mandate listing, the delivery-evidence query (QueryNotificationDeliveries — who was told what, when, on which channel, with what outcome), and the retention surfaces (show and set). Hands-on: opschain learn governance-notifications.
• The evidence ledger's auditor surfaces (GovernanceService): reading the ledger, verifying the chain, the auditor export lane and the posture report ride the readable /governance/evidence determination plus the pack; attestation writes and the re-anchor ride its updatable twin plus the pack, on the step-up floor; legal hold is an admin-plane act plus the pack, also stepped up. Hands-on: opschain learn governance-controls-evidence.
• The access-review campaign kind: opening an access-review campaign (OpenAccessReviewCampaign, admin + the pack) — the campaign kind is pack content behind the same gate, never a parallel one. Hands-on: opschain learn governance-campaigns.
• Step-up by policy: turning require_step_up or step_up_on_read on for an authorisation rule refuses without the pack — clearing a bit and every other rule write stay ungated, so a lapsed estate keeps editing rules and can always shed a demand. Enforcement of stored bits is likewise pack-gated (see the lapse posture below).
• The auditor security role: granting the auditor role on the Security Administration surface requires the pack; granting the security-administrator role does not.

What stays base

The enforcement half of every one of those surfaces ships ungated:

• Mandate enforcement — the engine's matching, the member-verb refusals (delete/mute/snooze/disable answer the typed MANDATED_SUBSCRIPTION reason) and the member-facing mandated-subscriptions listing (members must be able to see what binds them) never consult the licence, and neither does the retention reaper.
• Ledger recording — attestations keep landing (a campaign closing appends its attestation unentitled); only reading, verifying, exporting, hand-writing attestations and legal hold are the pack.
• The campaign machinery — cadences, campaign reads, decisions and closure — plus the control catalog, the waiver register and the remediation work items, which are deliberately never pack-gated so a lapse cannot hide open remediation work.
• The hard step-up verb floor — the built-in elevated-session demand on sensitive verbs is immovable and unaffected by the pack either way; the pack only gates policy-authored step-up on top of it.
• The access-review export — opschain admin authz review-export, the same dataset the campaign kind sources, stays base.

Tier-dependent retention

Notification retention is governed by the pack and shaped by the tier: on Basic the policy is fixed at 30 days feed / 90 days delivery evidence, and the set verb refuses — notification retention is fixed on the <tier> tier (30d feed / 90d evidence) - apply an enterprise licence to tune it. An Enterprise licence makes both tunable (defaults 90 days feed / 400 days evidence, each 1–3650 days, evidence ≥ feed enforced at write — delivery evidence outlives the feed on purpose).

Lapse posture

A lapsed entitlement freezes administration without dropping coverage: existing mandates keep matching and their members stay bound, delivery evidence keeps recording and the reaper keeps its configured windows — only the admin verbs above answer the typed refusal. Stored rule step-up bits are preserved but go inert, signalled by a throttled warn:licence:feature_refused event (surface authorisation_rule_step_up, at most once per hour per server process, never per request) — and the ledger keeps appending, so the evidence trail never gaps while the entitlement is sorted out.

Where the core documentation lives

• The governance foundation — controls, the ledger, campaigns, cadences, waivers and work items.
• Entitlements — resolution, tiers and the gate idiom this pack rides.
• The hands-on runbooks: opschain learn governance-controls-evidence, opschain learn governance-campaigns and opschain learn governance-notifications.
• opschain docs governance-matrix — the full per-RPC gate table.