{"slug":"architecture/007-governance-composition-and-execution","title":"ADR-007: Governance is Consulted During Composition and Enforced During Execution","section":"architecture","sectionLabel":"Architecture","status":"unclassified","type":"document","path":"architecture/007-governance-composition-and-execution.mdx","bytes":1489,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Accepted  \n**Date:** 2026-07-21  \n**Deciders:** Nirmal (Founder)\n\n---\n\n## Context\n\nGovernance (RBAC, policy, approval) needs to apply at two points: when composing the workbench (what the user sees) and when executing actions (what the user does). If governance only applies at execution, users see actions they can't perform.\n\n## Decision\n\nGovernance applies at **two gates**:\n\n1. **Composition gate:** Projection Engine evaluates governance for each capability when composing SharedWorkbench. The `governance` field tells the frontend which actions are allowed, which need approval, and which are denied.\n\n2. **Execution gate:** Capability Fabric re-evaluates governance before executing any action. This prevents TOCTOU (time-of-check-time-of-use) issues where policy changes between composition and execution.\n\n## Consequences\n\n- **Positive:** Users see accurate action availability. No surprise denials at execution time. Double-gated security.\n- **Negative:** Governance evaluation runs twice (compose + execute). Adds latency.\n- **Mitigation:** Composition gate uses cached policy. Execution gate uses fresh policy. Cache TTL is short (30s).\n\n## Evidence\n\n- `packages/projection-engine/src/evaluators/governance-evaluator.ts` — composition gate\n- `services/intelligence/src/govern.ts` — execution gate\n- `contracts/shared-workbench/v1.ts` — `governance` field in SharedWorkbench\n"}