Archigov · docs
  1. Docs
  2. Concepts

Conformance and Findings

Continuous evaluation of adopted rules and decision constraints against the derived model and imported evidence — findings that persist, exceptions that expire, and diffs per run.

#What Is Evaluated

Every adopted catalogue artefact with a rule is evaluated by one engine against the derived model and imported evidence. Rules come in two scopes:

  • Resource rules check each matching resource — a property, imported evidence, or the constraint of an accepted decision.
  • Application rules check each application — that it has an accepted decision on a topic, an owner tag, or no more than a number of resources of a type.

See the Rule DSL for the full grammar and Writing rules for a walkthrough.

Findings on the Conformance page
Conformance: findings with severity, the catalogue item they cite, the element, and the evidence behind them; decision drift, exceptions, conditions and run history have their own tabs.

#When It Runs

  • After every source sync (Azure, Defender, Policy, demo, imports).
  • Hourly, on a scheduler.
  • When an outcome takes effect (an artefact is adopted, a decision accepted, an exception granted).
  • On demand, by anyone holding the pre-review right, or the platform admin.

Each evaluation is a run that stores the number of findings and a list of changes: what opened, what resolved, what reopened.

One evaluation run — what happens to every adopted rule, for every element it matchesLanes: Sources, Engine, Findings, Board. Steps: Sync: Azure, Defender, Policy, imports (Sources); Update model and evidence (Engine); Evaluate adopted rules (Engine); Condition holds? (Engine); Finding opened or kept (Findings); Resolved if it was open (Engine); Active exception? (Findings); Excepted (Findings); Fix the estate, grant an exception, or resolve with a reason (Board); Run stores opened / resolved / reopened (Engine). Transitions: Sync: Azure, Defender, Policy, imports to Update model and evidence; Update model and evidence to Evaluate adopted rules; Evaluate adopted rules to Condition holds?; Condition holds? to Finding opened or kept (fails); Condition holds? to Resolved if it was open (passes); Finding opened or kept to Active exception?; Active exception? to Excepted (yes); Active exception? to Fix the estate, grant an exception, or resolve with a reason (no); Resolved if it was open to Run stores opened / resolved / reopened; Fix the estate, grant an exception, or resolve with a reason to Evaluate adopted rules (re-evaluated next run).SourcesEngineFindingsBoardSync: Azure, Defender,Policy, importsUpdate model andevidenceEvaluate adopted rulesalso hourlyConditionholds?Finding opened or keptfirst and last seenResolved if it wasopenActiveexception?ExceptedFix the estate, grantan exception, orresolve with a reasonRun stores opened /resolved / reopenedfailspassesyesnore-evaluated next run
One evaluation run — what happens to every adopted rule, for every element it matches

#Findings

A finding is keyed by a fingerprint — the artefact, the element and the application — so the same problem keeps the same finding across runs, with first seen and last seen dates. Every finding cites the artefact (or decision) it comes from and carries its evidence: the path, the expected and actual value, the imported evidence record, or the decision it contradicts.

StateMeaning
OpenThe condition holds now
ResolvedIt no longer holds — fixed in the estate, or closed by a human
ExceptedAn active exception covers it

A human with the right to resolve findings (a board chair) can close a finding with a reason; the name and reason stay on the finding. If the condition still holds on the next run, the finding reopens and an audit row says so. Closing a finding never hides a real problem.

#Missing Evidence Is a Finding

A rule that asserts on imported evidence (op: evidence) and finds no evidence for a resource reports no evidence imported — never a pass. Absence of proof is not proof.

#Rule Errors Are Never Passes

An unknown operator or an invalid regular expression makes the rule an error: the run lists it under rule errors and the artefact shows it. A broken rule never counts as conforming.

#Exceptions

An exception excepts one artefact for an application or element, with a reason and an optional expiry. Exceptions are granted by a board — normally by approving an exception review on the Policy & Compliance Board — and every one is in the audit chain. When an exception expires, the finding comes back. The governance starter pack includes a policy that mandatory-policy exceptions carry an expiry.

#Other Signals

Beyond rule findings, Archigov surfaces — on the Conformance page, the Planned Changes page and the Overview pipeline:

  • Decision drift — resources that contradict an accepted decision's constraint;
  • Expired exceptions and overdue conditions;
  • Changed after approval — work items whose requirements changed materially after their design was approved;
  • Epics without a decision — planned change that needs an architecture decision and has none.

#Per-area Findings on a Review

On a review, each touched area shows the pre-review findings whose citations resolve to an artefact in that area's categories, so a decision maker sees the findings that concern them first.