Governance Vocabulary
What is a governed mutation?
A governed mutation is a proposed business-data state change whose path to production is subject to defined governance controls.
Short answer
A governed mutation is a proposed business-data state change whose path to production is subject to defined governance controls.
Core explanation
A governed mutation is a proposed change to business data that must pass defined controls before it is allowed to reach production.
In ecommerce, a mutation could be something as simple as changing:
- a product title
- a description
- SEO metadata
- an image
- a product classification
- pricing or other catalog data
The important distinction is that a governed mutation is not treated as just another API write.
It carries context around the change itself.
For example:
- what is being changed
- who or what proposed the change
- what the previous value was
- which policy applies
- whether the proposed value complies with that policy
- whether human approval is required
- who approved or rejected it
- which version of the proposal was approved
- what was actually written to production
- whether the resulting production state was verified
- whether the change was later reversed
A simplified lifecycle might look like:
proposal → policy evaluation → review → approval → execution → verification → audit
Not every mutation needs every step.
A low-risk change might pass automatically when it satisfies policy, while a higher-risk or unusual change could require human approval.
The core idea is that the system governs the individual change, not only the identity of the person or agent making it.
That matters increasingly with AI agents.
An AI agent may be authorized to access a product catalog, but authorization alone does not determine whether every mutation it proposes should be allowed.
So a useful distinction might be:
ordinary mutation: a requested state change
governed mutation: a state change whose authority, policy, approval, execution, and outcome can be controlled and evidenced
As AI agents gain more production authority, should businesses start treating mutations themselves as governed objects rather than relying only on permissions around the systems that execute them?
CommerceGov position
CommerceGov uses this vocabulary for operational authority over business mutations. These are conceptual distinctions; they do not alone claim a particular shipped capability.
Key concepts
- governed mutation
- governed writeback
- access control versus change governance
- evidence of the lifecycle
Related resources
- What is a governance control plane for ecommerce operationsA governance control plane is a layer that governs the transition from proposed intent to production state; it is an architectural concept, not universally standardized terminology.
- What is a governed writebackA governed writeback is controlled execution of an authorized mutation into production, including relevant verification and audit evidence.
- What is the difference between access control and change governanceAccess control determines who or what can perform a class of action. Change governance decides whether a specific proposal is allowed under current policy, state, risk, and authority.
- Who should have authority to propose, approve, and execute an ecommerce changeProposal, approval, and execution are distinct authorities and may be logically separated even when low-risk policy permits an automated path.
- How do you verify that an automated ecommerce change was actually applied correctlyVerification compares intended and approved state with resulting production state. A successful write alone is not proof of a correct outcome.