What Governance Does Not Do
Governance answers one question: is this person allowed to do this? It enforces access. It does not do the other jobs around it.
| Governance does not… | Who does |
|---|---|
| Log people in. It does not check passwords or sign-ins. | CM.com sign-in (single sign-on). Governance receives the identity after the person has logged in. |
| Create users. It copies user details from CM.com Platform. | CM.com Platform. |
| Create API keys. It registers existing keys as product tokens. | CM.com Platform. |
| Store application data. It holds no business data such as messages, contacts or reports. | The application. |
| Decide what an application's permissions are. It stores and checks them. | The application's team. |
What this means in practice
- A person who can't log in has a sign-in problem, not an access problem.
- If a permission is missing from the list of choices, the application has not defined it.
- Governance tells an application "allow" or "deny". The application carries it out.