Open Source Specification

Data Governance
Framework

Transform "we claim compliance" into "we prove compliance" — executable governance with mathematical guarantees, attack-driven testing, and auditor-ready evidence.

11Components

82Golden Cases

30+Standards

16KLines

View on GitHub Explore Components

The Auditor Test

Three questions every regulator will ask. DGF makes each one answerable by design.

"You claim GDPR / DP / DSA compliance — where is the evidence?"

PAMOLA Evidence Packs

Sealed, versioned artifacts a reviewer can recompute

Dataset Tagging

Every dataset tagged with obligations

G10

Conformance Records

Verdicts bound to evidence bundles

"Can this decision and its basis be reproduced?"

Policy-as-Code

Deterministic gate engine

G10

Golden Cases

82 tests with exact outputs

Full Lineage

Any decision recomputed from inputs

"What happens when a violation occurs?"

Enforcement Invariants

Block non-conformant releases

Budget Hard-Gate

Commit-only ledger, no rollback

Cascade Revocation

Propagates to dependents

Claims vs. Proof

The difference between governance theater and executable compliance.

What Others Say

"We follow best practices"
"Our data is anonymized"
"We have policies in place"
"Trust our security team"
"We're GDPR compliant"

What DGF Proves

82 golden cases pass with exact outputs
ε=2.3 spent, 4.7 remaining (ledger proof)
G6 gate blocked release at 14:32:07 UTC
Pack sealed and versioned (recomputable)
EDPB 3-criteria attack coverage: 100%

Component Explorer

11 modular components. 5 governance layers. 16,000+ lines of specification.

Reference Map30+ standards

Tagging Scheme80+ tags · 10 layers

Lifecycle Model13-state machine

Quality Model6 dimensions

Normative Reference Map

Registry of 30+ external standards (ISO, GDPR, DAMA-DMBOK, DCAM) with source-to-component traceability matrix.

Key Capabilities

30+ normative sources

3-tier classification

Source-to-component mapping

Extraction matrices

Regulatory Coverage

GDPR HIPAA EU AI Act ISO 27001

Connects To

→ G1 Tagging → G4 Threats → G10 Conformance

See It In Action

Golden cases are JSON — auditors review specs, engineers write harnesses.

// G10 Golden Case — Gate blocks on budget exhaustion
{
  "id": "GC-G9-03",
  "title": "Budget exhaustion blocks synthesis",
  "priority": "P0",
  "input": {
    "requested_epsilon": 1.5,
    "current_budget": { "remaining": 0.8 }
  },
  "expected": {
    "verdict": "BLOCKED",
    "reason": "INV-L2: requested ε exceeds remaining"
  }
}

// G5 Evidence Pack — sealed, recomputable
{
  "pack_id": "EP-2026-02-08-001",
  "pack_seal": "sealed",
  "evidence_level": "L2_REVIEWED",
  "artifacts": [
    { "type": "QUALITY_METRICS", "level": "L1_AUTOMATED" },
    { "type": "GATE_DECISION", "verdict": "APPROVED" },
    { "type": "DPIA_FRAGMENT", "level": "L2_REVIEWED" }
  ],
  "verification": { "V03_recompute": true }
}

// G9 Budget Ledger — Commit-only semantics
{
  "total_budget": 7.0,
  "composition_method": "RDP_TO_DP",
  "ledger": [
    { "op": "DP_CTGAN", "ε": 3.2, "status": "COMMITTED" },
    { "op": "MARGINAL", "ε": 1.5, "status": "COMMITTED" },
    { "op": "ATTACK", "ε": 1.5, "status": "COMMITTED" }
  ],
  "state": { "consumed": 6.2, "remaining": 0.8 }
}

Where DGF Fits

The governance contract between applications and regulatory environment.

Application

Studio

PAMOLA.CORE

SYNT

PROCESSING

Governance

DATA GOVERNANCE FRAMEWORK — G0 G1 G2 G3 G4 G5 G6 G7 G8 G9 G10

Regulatory

GDPR

HIPAA

EU AI Act

CCPA

Ready to prove compliance?

DGF is open source. Explore the spec, run conformance tests, or discuss implementation.

GitHub Repository Discuss Implementation

pip install pamola-core

Data GovernanceFramework