1 · Need Discovery
The organisation defines the decision, problem, impact and owner before selecting technology.
A governed architecture connects need, design, assurance, testing, authorisation, observation and evidence without allowing self-authorisation.

The organisation defines the decision, problem, impact and owner before selecting technology.
The process becomes a design with explicit data, tools, permissions, autonomy and limits.
Independent assessment of risk, evidence, hard stops, guardrails and residual risk.
Adversarial testing of the exact version and failure paths relevant to the case.
A named accountable person accepts conditions, rejects or refers for specialist review.
Observation of change, incidents, permission expansion, drift and loss of effective human control.
Examines interactions and risks that do not appear when each agent is reviewed separately.
Preserves versions, decisions, tests, approvals and revalidation triggers under controlled access.
The same identity should not design, assess, approve, activate and audit a material decision.
Each stage produces a decision, an accountable owner and enough evidence for the next stage not to rely on blind trust.
It is which system you are prepared to authorise, under which limits and with what evidence.