Governance: When the Data Decides Whether It Participates
Not can this caller access this resource. Will this resource participate in what’s being asked of it.
Governance usually gets bolted onto a system from outside. A gate in front of the data. A permission checked at the door. An audit log consulted after the fact, once it’s too late to matter.
Flip that around. Instead of asking whether a caller can access a resource, ask whether the resource itself will participate in the activity being requested. A policy sits with the resource directly. I will participate in a read if a valid user can demonstrate this specific permission. Small reframing. Large consequence. The decision moves from a gate standing in front of the resource to the resource itself.
A Resource That Grows Without Restructuring
A personal weather station, sharing temperature readings, starts simple. Read and write your own data, nothing more. Over time, without a single table ever changing shape, the requirements grow. Daily averages for a metropolitan area get opened up publicly. A public read gets rate limited to ten times a month. Later, an export activity appears, governed by entirely different rules than a plain read, because sending data somewhere else carries different risk than reading it in place.
None of these changes touched structure. Every one of them was a policy change, sitting where it always sat, evaluated the same way it always was.
This Was Already Built, Piece by Piece
Nothing about this needs new machinery. Context was already defined earlier in this series, where, when, who. The Composer already resolves a different plan depending on entitlements, the same demand producing different routes for different callers. Envelope’s aspects already carry identity and authority directly, mutual TLS describing exactly who’s asking as part of the contract itself. Providence’s policy bundle already declares what’s permitted to happen to something next.
Get Stephen James Price’s stories in your inbox
Join Medium for free to get updates from this writer.
Governance isn’t a new system showing up at the end of this series to tie things off. It’s four things already built, pointed squarely at one question. Will this participate.
Zero Trust as the Honest Default
Every action gets mediated by something that evaluates policy before anything proceeds. Default deny, not default allow, is what it actually means for a resource to decide for itself. A caller with no applicable policy doesn’t get partial access, or a degraded version, or the benefit of the doubt. They get nothing. That’s not a failure case. It’s the correct, safe outcome, the same one a resource with no reason to trust a stranger would reach on its own.
It Was Never Only About Data
Replace “data” with “service,” and the same pattern governs a service mesh, not just whether a call is permitted, but where it even gets routed. Replace “data” with “any resource,” and it governs everything else this series has spent its length addressing, cataloguing, and composing. The idea was never specific to data. It just needed somewhere concrete to start.
Close
This series opened with systems forming themselves around outcomes, rather than being built in advance to anticipate them. It closes with the resources inside those systems having a genuine say in whether they participate at all, not because a gate happened to let them through, but because they were asked, and they decided.
Neither end of that arc needed boiling the ocean to get here. Small steps, the same discipline applied consistently, the whole way through.
