Appendix H

Governance Policy Schema (YAML & JSON)

This appendix defines a portable schema for expressing Constitutional Execution Infrastructure (CEI) governance policies. Policies are externalized from application code, allowing governance rules to evolve independently while remaining versioned, reviewable, and replayable.

Governance policies should be treated as managed artifacts rather than embedded implementation details.

1. Policy Structure

2. Example YAML

policy:
  id: payment-approval
  version: 1.2.0

authority:
  required: finance_manager

evidence:
  minimum:
    - invoice
    - purchase_order

risk:
  max_score: 30

decision:
  success: GO
  failure: DENY

3. Example JSON

{
  "policy": {
    "id": "payment-approval",
    "version": "1.2.0"
  },
  "authority": {
    "required": "finance_manager"
  },
  "risk": {
    "max_score": 30
  }
}

4. Authority Schema

• Role identifier.
• Delegation scope.
• Validity period.
• Optional delegation constraints.

5. Evidence Schema

• Evidence identifier.
• Evidence category.
• Minimum completeness.
• Optional provenance metadata.

6. Policy Versioning

7. Validation Rules

• Required sections MUST be present.
• Referenced roles SHOULD exist.
• Risk thresholds SHOULD be internally consistent.
• Policy documents SHOULD validate before deployment.

8. Conformance

A conforming implementation should load governance policies from portable schemas, preserve version history, and associate each runtime decision with the policy version used during evaluation.

Appendix Summary

The Governance Policy Schema enables organizations to exchange, version, review, and execute governance policies consistently across different CEI implementations.

Next: Appendix I — Enterprise Reference Architecture.