The Governance FlowEnterprise
How a use case moves through the governance lifecycle, from registration to active monitoring.
Every governed use case travels the same stage path. Each stage is where a defined set of work happens — capturing the use case, assessing its risks, treating them, getting approval, and then watching the live deployment. The stages are linear: a use case must satisfy the gate at the end of each stage before the next opens.
This page describes the default flow — the path a use case takes from registration through to active monitoring.
The stages
Register → [Triage → Build & Connect] → Assess → Mitigate → Approval → MonitorTriage and Build & Connect are conditional — they only fire when no asset is provided at Register. If the use case is registered with an asset already attached, both stages are skipped and the use case proceeds straight to Assess.
The registrant describes the use case's intended use and, where already available, links the asset(s) that implement it. An initial scoring of risks will be performed once the stage transitions. See Creating a Use Case for more details.
If an asset is linked at this stage, Triage and Build & Connect are skipped and the use case proceeds directly to Assess.
A first opportunity to perform exploratory assessments that give additional context for the use case's risks, excluding anything that depends on the asset itself, since it isn't connected yet. Proceeding from this stage asserts that the use case is preliminarily viable, and ready to return to the owner for building the proposed system.
Builder constructs the associated asset and connects it to the use case, enabling asset-aware assessment.
Execute deeper exploratory assessment(s), or re-run initial assessment(s) from triage. Confirm use case intended use, assessment results, and the assessed risk levels. Proceeding to mitigate signals that the use case and it's assets are accepted as a baseline.
This asserted baseline is stored as an imutable artifact,the Nutrition Label, which serves as the foundation of future stages.
Decide how to treat each applicable domain risk from the use case definition. An analysis of the residual risk levels are performed where any existing controls are identified for the use case. From that point, the goal is to mitigate the risks outside the tolerable range, and prepare the use case for approval. See Risk treatments for how each treatment type affects the residual score.
The evidence assembled across the previous stages — confirmed risks, treatment decisions, evaluation artifacts, residual scores — is packaged for a go / no-go gate decision.
Approvers review the full record and vote. When the approval gate resolves (per the configured approval logic), this stage's goal — the signed Receipt, recording the active controls behind the approved residual score — is sealed and the use case advances. Declining at this stage moves the use case out of the active flow.
The use case is now considered a live, governed object. Signals — usage patterns, security violations, guardrail effectiveness, drift — are watched against the associated assets.
For details on how use cases advance between stages — including approval modes, force override, and regression — see Use Case Workflow.