Governance

Governance centers on a few key abstractions that work together:

Governed bundles, or simply bundles, group related artifacts such as models, files, and data for a specific purpose or use case. Governance is applied at the bundle level through attached policies.

Policies define the workflows that guide a bundle through its lifecycle, from ideation to retirement. A bundle can have one or more policies applied, such as NIST AI RMF, SR 11-7, or Model Risk Management.

Only Governance administrators can create and maintain policies, while practitioners provide evidence and approvers review submissions.

Policies are fully customizable to match your interpretation of a regulation or framework. Each policy is structured into stages.

Stages represent key milestones in the policy lifecycle. Each stage contains one or more sections, which include questions called evidence. Evidence can take multiple forms: text inputs, file uploads, or structured selections.

Stages can also contain automated checks to validate evidence. These include metric evaluations, scripted validations, and connectors to external monitoring systems.

Policies can enforce sequential workflows where each stage must be completed before the next becomes available. This ensures structured progression and maintains control throughout the governance process. Sequential workflows are enabled in the Policy Builder.

Within a stage, you can define approvals to involve stakeholders in reviewing evidence before a bundle advances.

Approvals can also control transitions between stages. If a reviewer identifies an issue, they can create a finding to document and track it. Findings can be used in conditional approvals to ensure resolution before progression.

Gates control high-risk actions within Domino, such as publishing apps, deploying models, or accessing specific infrastructure. Policies define which actions are allowed and under what conditions. For example, a gate can restrict GPU access until required approvals are complete. Domino enforces these controls automatically, ensuring compliance without manual intervention.