The Governance FlowEnterprise
How a use case moves through the governance lifecycle, from registration to active monitoring.
Every governed use case travels the same stage path. Each stage is where a defined set of work happens — capturing the use case, assessing its risks, treating them, getting approval, and then watching the live deployment. The stages are linear: a use case must satisfy the gate at the end of each stage before the next opens.
This page describes the default flow — the path a use case takes from registration through to active monitoring.
The stages
Register → [Triage → Build & Connect] → Assess → Mitigate → Approval → MonitorTriage and Build & Connect are conditional — they only fire when no asset is provided at Register. If the use case is registered with an asset already attached, both stages are skipped and the use case proceeds straight to Assess.
The registrant describes the use case's intended use and, where already available, links the asset(s) that implement it. An initial scoring of risks will be performed once the stage transitions. See Creating a Use Case for more details.
If an asset is linked at this stage, Triage and Build & Connect are skipped and the use case proceeds directly to Assess.
A first opportunity to perform exploratory assessments that give additional context for the use case's risks, excluding anything that depends on the asset itself, since it isn't connected yet. Proceeding from this stage asserts that the use case is preliminarily viable, and ready to return to the owner for building the proposed system.
Builder constructs the associated asset and connects it to the use case, enabling asset-aware assessment.
Execute deeper exploratory assessment(s), or re-run initial assessment(s) from triage. Confirm use case intended use, assessment results, and the assessed risk levels. Proceeding to mitigate signals that the use case and it's assets are accepted as a baseline.
This asserted baseline is stored as an imutable artifact,the Nutrition Label, which serves as the foundation of future stages.
Decide how to treat each applicable domain risk from the use case definition. An analysis of the residual risk levels are performed where any existing controls are identified for the use case. From that point, the goal is to mitigate the risks outside the tolerable range, and prepare the use case for approval. See Risk treatments for how each treatment type affects the residual score.
The evidence assembled across the previous stages — confirmed risks, treatment decisions, evaluation artifacts, residual scores — is packaged for a go / no-go gate decision.
Approvers review the full record and vote. When the approval gate resolves (per the configured approval logic), this stage's goal — the signed Receipt, recording the active controls behind the approved residual score — is sealed and the use case advances. If the approvers' votes resolve as a rejection, the use case is moved to Quarantine and does not reach Monitor. See What a rejection does.
The use case is now considered a live, governed object. Signals — usage patterns, security violations, guardrail effectiveness, drift — are watched against the associated assets.
If something the use case depends on later changes in a way that matters, the use case gets a new version and returns to Assess. See Use Case Versions.
For details on how use cases advance between stages — including approval modes, force override, and regression — see Use Case Workflow.