Controls you can explain under review

Data separation, protected evidence, attributable actions, and role-based access are designed to be visible when governance asks why.