Governance in Data Domain
Capabilities
Per-app data grants
Each consuming app has declared read and write grants per domain.
Governed workflows
Cross-app workflows are declared, validated and executable.
Evidence
- Declared in apps/data-domain/seed-data/product-capabilities.json
- Resolved by apps/data-domain/scripts/check-alignment-registry.mjs
- Implemented in apps/data-domain/src/app.ts
- Implemented in packages/lasstech-core/src/auth/policy.ts
- Implemented in apps/data-domain/src/routes
- Implemented in docker-compose.local.yml
Security
Running with no outbound connection
The model provider is a configuration choice · Reference data ships with the deployment, not copied into each app · The data stores are yours
Identity and access
One session, verified by every product · Multi-factor authentication · Revocation is checked when a session is used, not only when it is issued · Redirects are allowlisted · Permission resolves on role AND calling application
How the software is kept honest
Dependency vulnerabilities fail the build · A measured quality position, published with its coverage · The marketing claims on this site are gated