Automated Governance: does the TAG want it back as an initiative, and where do its documents live?

[astrogilda]

Automated Governance has a finished deliverable and no longer has a home in the tree. The working group's README and the Automated Governance Maturity Model both sit in cncf/tag-security, archived and last pushed 2025-12-08. The controls catalog and supply-chain work that succeeded it sit in cncf/toc/tags/tag-security-and-compliance/.

The maturity model is about eighteen kilobytes of finished text. It gives an organization a scale for the maturity of the controls an automated governance programme needs, without scoring a specific implementation.

Does the TAG want Automated Governance back as an initiative, and where do its documents live now the source repository is archived? If the answer to the first is yes, I will do the carry-across. That means porting the maturity model to the new location, opening the PR, and taking the initiative's maintenance.

The scale has a shipped consumer: four admission rails, OPA rego, Kyverno CEL, Kyverno JMESPath and CUE, run in CI at https://github.com/probityai/agent-evidence-admission

Edited 2026-09-22: updated a repository URL to its current path, and split one long sentence in two.

[brandtkeller]

comment for posterity - I think this is a good candidate for the contribute-site given that it has value to readers externally and that repo has a public-facing site.

As for future work - TAG-SC leads can weigh in on how/whether to proceed with a new potential initiative if that is what is being proposed.

[eddie-knight]

I don't suppose a new initiative would be needed here, unless someone raises a significant concern that needs concerted effort.