Content governance & approval for regulated content
Purpose: Platform controls for content that carries legal/regulatory weight — pricing, terms, claims — beyond ordinary review.
Who this page is for
| Audience | Why it matters to you |
|---|---|
| Tech leads | Control designers |
| All engineers | Building the guardrails |
What counts as regulated (decide with legal/compliance, once)
For the fictional PHI: premiums and pricing statements, coverage terms, health claims in marketing copy, mandated disclaimers. The register of "which content classes need which controls" is the governance foundation — engineering implements it, compliance owns it.
The control set, mapped to platform features
| Control | Implementation |
|---|---|
| Regulated content cannot go live unapproved | Approval workflow enforced by ACL (authors lack replicate on those trees — Lab 9 pattern), reviewer group = compliance-trained users |
| Mandated text appears exactly once, correctly, everywhere | Disclaimer as referenced Content Fragment (one source of truth); components render it non-editable in context |
| Pricing is never hand-typed | Premiums render from synced CF data (PIM pattern) — authors compose around figures they cannot alter |
| Changes are traceable to an approver | Workflow history + audit trail |
| Time-bound content leaves on time | On/off times + expiry reports; an expired offer still live is a compliance incident, so alert, don't just schedule |
| Big regulated changes land atomically | Launches + freeze windows (content freeze) |
Engineering guardrails worth building
- Component-level validation: the plan-card refuses to render a premium without its disclaimer reference (fail visible on author, fail safe on publish).
- Pre-publish checks as workflow steps: broken references, missing mandatory fields, disclaimer-version staleness (custom process).
- A "regulated tree" lint report: pages under /content/phi/plans lacking approval metadata or carrying overridden inherited disclaimers (MSM hygiene).
The pattern across all of these: make the compliant path the easy path — validation and referenced fragments beat training and memos every audit season.