Skip to content

Policy Inheritance Matrix

Governance model — instantiates Controlled Inheritance Propagation

A grid of policies against organizational scopes that shows, per cell, what is inherited, what is locally overridden, what is mandatory-locked — and who owns each row.

A Policy Inheritance Matrix is a governance artifact: a grid of policies (rows) against organizational scopes (columns — the enterprise, its divisions, subsidiaries, teams) whose every cell records, for that policy at that scope, whether it is inherited unchanged, locally tightened, exempted, or mandatory-and-locked. Its distinctive move among the siblings is the two-dimensional applicability view — it does not just cascade one rule down one line, it shows a whole portfolio's inheritance and exceptions at once — paired with a named steward on every row, so "who decides whether this policy may be overridden here" is never ambiguous. It is the sibling that governs many policies across many scopes as a single legible surface.

Example

A multinational maintains policies for data retention, a security baseline, expense approval, remote work, and code of conduct. The matrix lays these as rows and its org units as columns. The security baseline and code of conduct are marked mandatory floor in every column — inherited and locked, no local override permitted. Data retention is inherited by default, but the cell for the EU subsidiary is marked locally tightened, since local law requires shorter retention; the matrix records that override with a reason and an owner. Expense approval is local by default: the parent publishes a recommended threshold and each unit may set its own.

Every row carries a steward — the CISO owns the security baseline, Legal owns retention. So when a national works council negotiates a remote-work exception, the change lands in exactly one cell, is visible to anyone reading that unit's column, and is signed off by the row's owner instead of slipping in unrecorded. The matrix turns "which of our policies actually applies to this subsidiary, and who approved the difference" from a scavenger hunt into a single lookup.

How it works

  • Cross policies with scopes. Policies on one axis, organizational units on the other; each intersection is a decision, not a blank.
  • Classify each cell. Inherited, locally tightened, exempted, or mandatory-locked — a small fixed vocabulary of override states.
  • Mark the invariant floor. Rows or cells no descendant may override are flagged as non-negotiable and rendered distinctly.
  • Name a steward per row. Each policy has an accountable owner who governs its propagation and approves any exception.
  • Read both ways. A column gives one unit's effective policy set; a row shows how a single policy varies across the whole org.

Tuning parameters

  • Floor height — how many policies are mandatory-locked versus locally adjustable. A high floor guarantees consistency but ignores local law and context; a low floor respects locality but invites drift and gaps.
  • Cell vocabulary — how many override states the grid distinguishes (bare inherit/override, or inherit/tighten/exempt/waive-with-expiry). Richer states capture nuance at the cost of upkeep.
  • Steward granularity — one owner per policy row, or per cell. Per-cell ownership scales accountability in a large org but multiplies coordination.
  • Attestation cadence — how often each cell is re-confirmed against reality. Frequent attestation catches stale exemptions; rare attestation lets the grid drift into fiction.

When it helps, and when it misleads

Its strength is a single legible surface for "what applies where, and who says so." Scattered policy exceptions become visible, owned cells; the mandatory floor keeps non-negotiables genuinely non-negotiable, while everything above the floor follows subsidiarity[1] — handled at the most local level that can handle it.

It misleads because a matrix is only as true as its last attestation. Cells go silently stale as reality moves, and a floor set too high invites quiet non-compliance in the units it does not fit. The classic misuse is marking a cell "compliant / inherited" to close an audit finding rather than because the policy is actually applied — at which point the grid becomes theater. The discipline that keeps it honest is that every cell carries a named owner and an attestation date, and every override carries a reason, so the matrix records decisions actually made, not intentions.

How it implements the components

  • default_propagation_rule — the standing default that a policy set at one scope applies to every scope beneath it unless a cell says otherwise.
  • invariant_vs_default_boundary — the mandatory-floor marking that separates locked policies from those a descendant may adjust.
  • lineage_stewardship_owner — the per-row (or per-cell) accountable owner who governs propagation and signs off exceptions.

It does not carry the fine-grained clause text of an override (override_scope_declaration — that's Template Clause Override Register), trace the downstream impact of changing a parent policy (ancestor_change_impact_trace — Lineage Impact Analysis Report), or expire exemptions on a schedule (override_review_and_sunset_rule — Override Expiry Workflow).

Notes

The matrix shows applicability, not enforcement: a cell marked "inherited" is a claim that some real control, config, or process actually applies the policy at that scope. Keeping the matrix honest therefore means linking cells to the mechanisms that enforce them, so the grid stays a map of reality rather than of intent.

References

[1] The governance principle that a matter should be handled at the most local level capable of handling it, with higher levels acting only where local ones cannot. It explains why only some policies are mandated from the center (the floor) while the rest are left open to local override. ↩