Inheritance
How each Control resolves along the tree from platform to Studio to Startup, and how the platform proves every Startup runs the same tested Versions.
A Startup inherits every Control above it in the tree, from the platform through its Studio. It can tighten an inherited Control and can never loosen one.
One tree, nearest first
The platform, each Studio and each Startup is a namespace. Controls resolve the way Settings do: a namespace reads the nearest value set above it.
Every Control value is a locked floor. A descendant may raise it and never lower it.
So one check proves the whole tree: no Setting sits below its ancestor's floor. Inherited floors runs that check over every namespace, every day.
Three answers
Resolution gives each Control one of three answers in each namespace.
| Resolution | Who operates it | Example |
|---|---|---|
inherited | The platform or the Studio, with no act by the Startup | Append-only records: no writer can delete an Event |
shared | The platform, on values the Startup sets | Retention restriction: the platform enforces the retention the Startup sets per Purpose |
owned | The Startup alone | Policy approval: an officer of the Startup's Company signs |
Most Controls resolve to inherited for most Startups. The shared and owned remainder is the Startup's floor.
Wakes
A Control can wake as a Startup grows. Adding a field that holds patient data wakes Health data agreements. Seating the first Human Worker wakes the human side of the people Controls, such as background checks.
Connecting an Integration to an upstream with no current report wakes Upstream review. Each wake is checked on the Change that causes it.
Control wake review opens a Task before that Change merges. A Startup never runs, even for an hour, outside a Control it has woken.
Same Control, same Version
Inheritance is a claim, and sameness proves it. An auditor who tests one Control needs to know that a thousand Startups ran the Control it tested, not copies that drifted.
Control sameness reads the content hash of every Version that implements a Control, and the resolved Settings in each namespace. It answers in one of two ways: identical within tested bounds, or a list of strata, each naming the Change that created it.
The auditor then tests each stratum once instead of each Startup. That is what lets one engagement cover a Studio of any size.
Buying from a sibling
A Startup that buys an outcome from a sibling under an Agreement inherits the sibling's Controls for that work. The sibling becomes an inclusive subservice organization in the buyer's report, and the sibling's customer controls join the buyer's floor.
Take a support desk for online course creators that buys bookkeeping from a sibling. It inherits the sibling's Controls over the ledger. Its own floor gains one item: approving what it sends the sibling to book.
Next
- The floor: what resolution leaves each Startup.
- How proof works: how every inherited Control is tested.