{
  "title": "Approvals and evidence",
  "status": "published",
  "last_updated": "2026-08-31",
  "controls": [
    "risk classification",
    "scoped authorization",
    "approval state",
    "idempotency for non-read actions",
    "linked evidence",
    "audit events"
  ],
  "failure_mode": "fail-closed"
}