From c96d52d6ef7f70b4002ef369be179c3fb7f4d821 Mon Sep 17 00:00:00 2001
From: mblanke <mblanke@gmail.com>
Date: Wed, 24 Dec 2025 12:51:34 -0500
Subject: [PATCH] Define canonical analyst flows

---
 governance/FLOWS.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 governance/FLOWS.md

diff --git a/governance/FLOWS.md b/governance/FLOWS.md
new file mode 100644
index 0000000..edd39f4
--- /dev/null
+++ b/governance/FLOWS.md
@@ -0,0 +1,12 @@
+Canonical flow (both apps):
+
+1. Data enters system
+2. Findings are generated
+3. Findings are normalized
+4. Analyst reviews findings
+5. Analyst takes action or escalates
+
+Rules:
+- No app may bypass normalization
+- No alert without a finding
+- All actions trace back to a finding