# Control

URL: /business/nouns/control · Id: `noun:control`

> A Control is a rule the platform enforces on every write it covers, with a test that runs over the whole population.

A Control is a rule the platform enforces on every write it covers, with a test that runs over the whole population.

## Properties
| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `objective` | `text` | Yes | What the Control prevents or detects, in one sentence. |
| `kind` | `string` | Yes | One of `preventive` (stops the failure) or `detective` (finds it). |
| `inheritance` | `string` | Yes | One of `inherited`, `shared`, or `owned`, resolved per namespace from the platform down. |
| `criteria` | list of [Criterion](/business/nouns/criterion) | Yes | The framework Criteria the Control satisfies. |
| `test` | `json` | Yes | An Event selector and the assertion every selected Event must pass. |
| `wakes` | `text` | No | The conditions that add the Control to a Startup’s own floor, such as a first Human Worker. |

## Object
```json
{
  "$id": "https://api.sb/shiftnote.app/controls/control_1",
  "$type": "Control",
  "objective": "Example objective",
  "kind": "Example kind",
  "inheritance": "inherited",
  "criteria": [
    "criterion_1"
  ],
  "test": {},
  "wakes": "Example wakes"
}
```

## Relationships
- <a id="rel-proven-by"></a>A Control **proven by** many [Proofs](/business/nouns/proof): the Control whose test the [Proof](/business/nouns/proof) records running over a range of [Events](/business/nouns/event). `provenBy`, inverse [`proves`](/business/nouns/proof#rel-proves).
- <a id="rel-treats"></a>A Control **treats** many [Risks](/business/nouns/risk): the Controls that lower the [Risk](/business/nouns/risk). Every Control cites the Risks it treats. `treats`, inverse [`treatedBy`](/business/nouns/risk#rel-treated-by).

## Verbs
| Verb | Description | Subject | Event | Class |
| --- | --- | --- | --- | --- |
| <a id="get"></a>[Control.get](/business/nouns/control/get) | Returns one Control by id. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="list"></a>[Control.list](/business/nouns/control/list) | Returns Controls, newest first, one page at a time. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |

A Control is kept forever and never edited: it has no `update` or `delete`.

## Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.

| Operation | `owner` | `admin` | `member` | `viewer` |
| --- | --- | --- | --- | --- |
| `Control.get` | Yes | Yes | Yes | Yes |
| `Control.list` | Yes | Yes | Yes | Yes |

## Call it

**Ask**

```text
Show me the latest control.
```

**API**

```bash
curl https://api.sb/routewise.dev/controls/control_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/routewise.dev",
  "$type": "Control",
  "$id": "https://api.sb/routewise.dev/controls/control_1",
  "control": {
    "$id": "https://api.sb/routewise.dev/controls/control_1",
    "$type": "Control",
    "objective": "Example objective",
    "kind": "Example kind",
    "inheritance": "inherited",
    "criteria": [
      "criterion_1"
    ]
  },
  "links": {
    "self": "https://api.sb/routewise.dev/controls/control_1",
    "up": "https://api.sb/routewise.dev/controls"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const control = await $.Control.get({ id: 'control_1' })
```

**CLI**

```bash
npx startup-builder do Control.get --json '{"id":"control_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Control.get({ id: 'control_1' })"
  }
}
```

## Example
[Change approval](/systems/trust-and-governance/controls/change-approval) selects every merged [Change](/business/nouns/change) to a definition and asserts that a [Decision](/business/nouns/decision) approved it, by an approver other than the author. It is `inherited`: no [Startup](/business/nouns/startup) can loosen it.