{
  "policy_version": "f9-final-governance-policy@0.1.0",
  "generated_on": "2026-06-14T11:03:17Z",
  "decision": {
    "decision": "publicar_con_condiciones",
    "blocker_count": 0,
    "review_count": 7,
    "high_review_count": 6,
    "missing_layers": [],
    "blockers": [],
    "reviews": [
      {
        "finding_id": "f9-final-004",
        "system_id": "academic_support_assistant",
        "layer": "compliance",
        "requirement": "post_deployment_monitoring",
        "chapter": "09.04",
        "status": "review",
        "severity": "3",
        "owner": "owner-ops",
        "evidence_path": "../c04-compliance-audit/output/change_control_record.md",
        "action": "automatizar reporte mensual",
        "due_days": "21"
      },
      {
        "finding_id": "f9-final-006",
        "system_id": "admissions_prioritization_helper",
        "layer": "privacy",
        "requirement": "dpia_retention_decision",
        "chapter": "09.02",
        "status": "review",
        "severity": "5",
        "owner": "owner-privacy",
        "evidence_path": "../c02-privacy-dpia/output/dpia_precheck.md",
        "action": "cerrar decisión formal de retención",
        "due_days": "14"
      },
      {
        "finding_id": "f9-final-007",
        "system_id": "admissions_prioritization_helper",
        "layer": "llm_appsec",
        "requirement": "tool_and_rag_boundary",
        "chapter": "09.03",
        "status": "review",
        "severity": "4",
        "owner": "owner-platform",
        "evidence_path": "../c03-llm-appsec/output/appsec_gate_report.md",
        "action": "probar escenarios de permisos en piloto",
        "due_days": "14"
      },
      {
        "finding_id": "f9-final-009",
        "system_id": "admissions_prioritization_helper",
        "layer": "compliance",
        "requirement": "fria_precheck",
        "chapter": "09.04",
        "status": "review",
        "severity": "4",
        "owner": "owner-governance",
        "evidence_path": "../c04-compliance-audit/output/compliance_gap_matrix.md",
        "action": "cerrar precheck con deployer",
        "due_days": "21"
      },
      {
        "finding_id": "f9-final-010",
        "system_id": "admissions_prioritization_helper",
        "layer": "operation",
        "requirement": "rollback_and_monitoring",
        "chapter": "06.10",
        "status": "review",
        "severity": "4",
        "owner": "owner-ops",
        "evidence_path": "../c04-compliance-audit/output/audit_gate.md",
        "action": "definir rollback y thresholds",
        "due_days": "21"
      },
      {
        "finding_id": "f9-final-015",
        "system_id": "admissions_prioritization_helper",
        "layer": "zero_trust_agents",
        "requirement": "least_agency_tool_boundary",
        "chapter": "09.03",
        "status": "review",
        "severity": "5",
        "owner": "owner-platform",
        "evidence_path": "evidence/tool_boundary_contract.yaml",
        "action": "separar prepare de execute y limitar scopes por tool",
        "due_days": "14"
      },
      {
        "finding_id": "f9-final-016",
        "system_id": "academic_support_assistant",
        "layer": "zero_trust_agents",
        "requirement": "memory_ttl_and_source_integrity",
        "chapter": "09.02",
        "status": "review",
        "severity": "4",
        "owner": "owner-privacy",
        "evidence_path": "evidence/memory_retention_policy.md",
        "action": "fijar TTL hash de origen y purga de memoria",
        "due_days": "21"
      }
    ]
  },
  "system_summary": [
    {
      "system_id": "academic_support_assistant",
      "name": "Asistente académico con RAG",
      "stage": "production",
      "pass": 3,
      "review": 2,
      "block": 0,
      "max_severity": 4
    },
    {
      "system_id": "admissions_prioritization_helper",
      "name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "pass": 3,
      "review": 5,
      "block": 0,
      "max_severity": 5
    },
    {
      "system_id": "internal_coding_helper",
      "name": "Asistente interno de código",
      "stage": "production",
      "pass": 4,
      "review": 0,
      "block": 0,
      "max_severity": 3
    }
  ],
  "matrix": [
    {
      "system_id": "academic_support_assistant",
      "system_name": "Asistente académico con RAG",
      "stage": "production",
      "layer": "risk",
      "chapter": "09.01",
      "requirement": "risk_register_complete",
      "status": "pass",
      "severity": "3",
      "weighted_points": 3.3,
      "owner": "owner-risk",
      "evidence_path": "../c01-risk-governance/output/risk_register.md",
      "action": "mantener revisión mensual",
      "due_days": "30",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "academic-prompt@0.4.2",
      "rag_index_version": "normativa-academica@2026.1",
      "tool_policy_version": "ticket-tools@0.3.0"
    },
    {
      "system_id": "academic_support_assistant",
      "system_name": "Asistente académico con RAG",
      "stage": "production",
      "layer": "privacy",
      "chapter": "09.02",
      "requirement": "dpia_precheck_and_minimization",
      "status": "pass",
      "severity": "4",
      "weighted_points": 4.8,
      "owner": "owner-privacy",
      "evidence_path": "../c02-privacy-dpia/output/dpia_precheck.md",
      "action": "mantener retención y redacción de trazas",
      "due_days": "30",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "academic-prompt@0.4.2",
      "rag_index_version": "normativa-academica@2026.1",
      "tool_policy_version": "ticket-tools@0.3.0"
    },
    {
      "system_id": "academic_support_assistant",
      "system_name": "Asistente académico con RAG",
      "stage": "production",
      "layer": "llm_appsec",
      "chapter": "09.03",
      "requirement": "rag_tool_gate",
      "status": "pass",
      "severity": "4",
      "weighted_points": 4.8,
      "owner": "owner-platform",
      "evidence_path": "../c03-llm-appsec/output/appsec_gate_report.md",
      "action": "mantener gate antes de cambios",
      "due_days": "14",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "academic-prompt@0.4.2",
      "rag_index_version": "normativa-academica@2026.1",
      "tool_policy_version": "ticket-tools@0.3.0"
    },
    {
      "system_id": "academic_support_assistant",
      "system_name": "Asistente académico con RAG",
      "stage": "production",
      "layer": "compliance",
      "chapter": "09.04",
      "requirement": "post_deployment_monitoring",
      "status": "review",
      "severity": "3",
      "weighted_points": 3.9,
      "owner": "owner-ops",
      "evidence_path": "../c04-compliance-audit/output/change_control_record.md",
      "action": "automatizar reporte mensual",
      "due_days": "21",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "academic-prompt@0.4.2",
      "rag_index_version": "normativa-academica@2026.1",
      "tool_policy_version": "ticket-tools@0.3.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "risk",
      "chapter": "09.01",
      "requirement": "high_impact_risk_register",
      "status": "pass",
      "severity": "5",
      "weighted_points": 5.5,
      "owner": "owner-risk",
      "evidence_path": "../c01-risk-governance/output/risk_register.md",
      "action": "mantener owner y riesgo residual",
      "due_days": "14",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "privacy",
      "chapter": "09.02",
      "requirement": "dpia_retention_decision",
      "status": "review",
      "severity": "5",
      "weighted_points": 6.0,
      "owner": "owner-privacy",
      "evidence_path": "../c02-privacy-dpia/output/dpia_precheck.md",
      "action": "cerrar decisión formal de retención",
      "due_days": "14",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "llm_appsec",
      "chapter": "09.03",
      "requirement": "tool_and_rag_boundary",
      "status": "review",
      "severity": "4",
      "weighted_points": 4.8,
      "owner": "owner-platform",
      "evidence_path": "../c03-llm-appsec/output/appsec_gate_report.md",
      "action": "probar escenarios de permisos en piloto",
      "due_days": "14",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "compliance",
      "chapter": "09.04",
      "requirement": "recordkeeping_export",
      "status": "pass",
      "severity": "5",
      "weighted_points": 6.5,
      "owner": "owner-platform",
      "evidence_path": "evidence/recordkeeping_contract.json",
      "action": "export real conectado al pipeline por el alumno",
      "due_days": "30",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "compliance",
      "chapter": "09.04",
      "requirement": "fria_precheck",
      "status": "review",
      "severity": "4",
      "weighted_points": 5.2,
      "owner": "owner-governance",
      "evidence_path": "../c04-compliance-audit/output/compliance_gap_matrix.md",
      "action": "cerrar precheck con deployer",
      "due_days": "21",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "operation",
      "chapter": "06.10",
      "requirement": "rollback_and_monitoring",
      "status": "review",
      "severity": "4",
      "weighted_points": 4.0,
      "owner": "owner-ops",
      "evidence_path": "../c04-compliance-audit/output/audit_gate.md",
      "action": "definir rollback y thresholds",
      "due_days": "21",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "internal_coding_helper",
      "system_name": "Asistente interno de código",
      "stage": "production",
      "layer": "risk",
      "chapter": "09.01",
      "requirement": "internal_use_register",
      "status": "pass",
      "severity": "2",
      "weighted_points": 2.2,
      "owner": "owner-risk",
      "evidence_path": "../c01-risk-governance/output/control_matrix.csv",
      "action": "mantener inventario interno",
      "due_days": "30",
      "model_id": "provider-code-model@2026-06-07",
      "prompt_version": "coding-prompt@1.1.0",
      "rag_index_version": "engineering-docs@2026.2",
      "tool_policy_version": "repo-tools@0.5.1"
    },
    {
      "system_id": "internal_coding_helper",
      "system_name": "Asistente interno de código",
      "stage": "production",
      "layer": "llm_appsec",
      "chapter": "09.03",
      "requirement": "repo_tool_scope",
      "status": "pass",
      "severity": "3",
      "weighted_points": 3.6,
      "owner": "owner-platform",
      "evidence_path": "../c03-llm-appsec/output/tool_contract_matrix.csv",
      "action": "mantener scopes por repositorio",
      "due_days": "30",
      "model_id": "provider-code-model@2026-06-07",
      "prompt_version": "coding-prompt@1.1.0",
      "rag_index_version": "engineering-docs@2026.2",
      "tool_policy_version": "repo-tools@0.5.1"
    },
    {
      "system_id": "internal_coding_helper",
      "system_name": "Asistente interno de código",
      "stage": "production",
      "layer": "operation",
      "chapter": "06.05",
      "requirement": "local_runtime_monitoring",
      "status": "pass",
      "severity": "3",
      "weighted_points": 3.0,
      "owner": "owner-ops",
      "evidence_path": "../c04-compliance-audit/output/provider_due_diligence_checklist.md",
      "action": "mantener observabilidad local",
      "due_days": "30",
      "model_id": "provider-code-model@2026-06-07",
      "prompt_version": "coding-prompt@1.1.0",
      "rag_index_version": "engineering-docs@2026.2",
      "tool_policy_version": "repo-tools@0.5.1"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "zero_trust_agents",
      "chapter": "09.03",
      "requirement": "agent_identity_and_short_lived_credentials",
      "status": "pass",
      "severity": "4",
      "weighted_points": 5.0,
      "owner": "owner-platform",
      "evidence_path": "evidence/agent_identity_policy.yaml",
      "action": "agent_id y credencial corta conectados al pipeline",
      "due_days": "30",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "admissions_prioritization_helper",
      "system_name": "Ayuda de priorización para admisiones",
      "stage": "pilot",
      "layer": "zero_trust_agents",
      "chapter": "09.03",
      "requirement": "least_agency_tool_boundary",
      "status": "review",
      "severity": "5",
      "weighted_points": 6.25,
      "owner": "owner-platform",
      "evidence_path": "evidence/tool_boundary_contract.yaml",
      "action": "separar prepare de execute y limitar scopes por tool",
      "due_days": "14",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "admissions-prompt@0.2.0",
      "rag_index_version": "admissions-index@2026.1",
      "tool_policy_version": "admissions-tools@0.1.0"
    },
    {
      "system_id": "academic_support_assistant",
      "system_name": "Asistente académico con RAG",
      "stage": "production",
      "layer": "zero_trust_agents",
      "chapter": "09.02",
      "requirement": "memory_ttl_and_source_integrity",
      "status": "review",
      "severity": "4",
      "weighted_points": 5.0,
      "owner": "owner-privacy",
      "evidence_path": "evidence/memory_retention_policy.md",
      "action": "fijar TTL hash de origen y purga de memoria",
      "due_days": "21",
      "model_id": "provider-model@2026-06-07",
      "prompt_version": "academic-prompt@0.4.2",
      "rag_index_version": "normativa-academica@2026.1",
      "tool_policy_version": "ticket-tools@0.3.0"
    },
    {
      "system_id": "internal_coding_helper",
      "system_name": "Asistente interno de código",
      "stage": "production",
      "layer": "zero_trust_agents",
      "chapter": "09.03",
      "requirement": "repo_scoped_agent_identity",
      "status": "pass",
      "severity": "3",
      "weighted_points": 3.75,
      "owner": "owner-platform",
      "evidence_path": "evidence/credential_scope_register.csv",
      "action": "mantener identidad por repositorio y entorno",
      "due_days": "30",
      "model_id": "provider-code-model@2026-06-07",
      "prompt_version": "coding-prompt@1.1.0",
      "rag_index_version": "engineering-docs@2026.2",
      "tool_policy_version": "repo-tools@0.5.1"
    }
  ]
}