Control

packs:security-governance

A control is a named, owned, reviewable statement about enforcement — "this is governed, this role owns it" — distinct from the enforcement instruments (policies, mandates, windows, grants) that implement it. Controls anchor the governance surfaces: cadences schedule their reviews, campaigns review them, waivers record exceptions against them. Served by the v2 GovernanceService: ListControls, GetControl, CreateControl and UpdateControl (controls retire; they are never deleted).

Control

Control is a named, owned, reviewable statement about enforcement — not an enforcement instrument itself.

Field	Type	Meaning
created_at	timestamp	When the record was created.
created_by	string	Username of the creating identity.
description	string	Free-text description.
domain	string	The governance domain: "security" | "change" | "agent".
id	string	The record's identity.
instrument_refs	array of InstrumentRef	The instruments implementing this control; empty means a procedural control attested by humans.
key	string	The unique catalog key, e.g. "path-rbac-posture".
name	string	Display name.
owner_role	string	The role accountable for the control's reviews.
status	string	"active" | "retired".
updated_at	timestamp	When the record was last updated.

InstrumentRef

InstrumentRef points a control at one mechanism that implements it by {kind, id}, leaving the instrument's schema untouched.

Field	Type	Meaning
id	string	The instrument's id in its own table.
kind	string	The instrument family, e.g. "authorisation_policy", "notification_mandate", "maintenance_window", "trust_grant".

Related pages

• opschain docs governance — the controls register and the review lifecycle around it.
• opschain docs resources/cadence — the review schedule a control carries.
• opschain docs resources/waiver — exceptions recorded against a control.
• opschain docs governance-matrix — how controls map onto the enforcement instruments.