05 — Process Governance Model & Gap Surface

Governance object types

• process_axis (AX-PROCESS itself)
• process_definition (a workflows row / Type-2 pipeline)
• process_version (workflows.version / superseded_by)
• process_step (workflow_steps)
• process_component (DOT/job/event linked to a step)
• process_run_policy (lease/retry/backoff in dot_config; Điều-45)
• human_task_policy (deadline/assignee/escalation on tasks/MOT)
• escalation_policy (overdue→escalated transitions)

Ownership model (4 roles)

role	gov ref	source
technical owner	GOV-MOW	def-side, Mother of Workflows
business owner	per-process (category-derived)	workflow_categories / owner_gov_code
executor owner	GOV-DOT	execution scope (responsibility_scope)
governance council	GOV-COUNCIL	approval/activation/rollback (Điều-32)

Health/audit = GOV-SIV; render = GOV-MOUT (existing 6 scopes cover this — no new scope needed).

Approval states (reuse existing apr vocabulary)

draft/candidate → approved → active → change_requested → deprecated → retired. Mapped onto live tables:

• workflow_change_requests = the Kaizen/change channel (change_type, dsl_diff, approved_by, applied_at) — reuse, do not rebuild.
• approval_requests = the cross-object governance gate. ⚠ action='add' AUTO-APPROVES (fn_auto_approve_add) and every insert births → any AI-proposed process governance request MUST use action='review', and each insert is an unretirable birth (so the pilot inserts none — ownership bootstrap is queued as a named request code, not a row, to avoid premature births; see 12).

Governance gap surface — LIVE

v_axis_process_governance_gap (4 rows today, all OWNER_MISSING because governance_object_ownership is empty system-wide):

object_type	object_ref	gap_detail
process_axis	AX-PROCESS	no_owner
process_definition	WF-001	no_owner; no_iu_sop_binding; no_health_dot
process_definition	WF-002	no_owner; no_iu_sop_binding; no_health_dot
process_candidate	PIPELINE:cut	unborn; no_owner; no_iu_sop_binding; no_health_dot

Gap dimensions encoded: process has no owner / no IU-SOP / active process has no health check / components not governed / trigger but no registry / unborn. As ownership rows are added (owner-gated), OWNER_MISSING flips to OWNED automatically via the LEFT JOIN — no view change.

Forbidden / honoured

No faked ownership (governance_object_ownership untouched, stays 0). No process promoted to active. Gap surface is read-only and propose-only (Điều-39).