Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

docs/02-security/POLICY_GOVERNANCE_RUNTIME.md

@@ -0,0 +1,15 @@
+# Policy governance runtime
+
+WP-110 provides one deterministic evaluator for management simulation, the dataplane router, and first-party connector invocation adapters. Rules are parsed into typed selectors and evaluated in this order:
+
+1. missing binding is denied;
+2. terminal global denials are evaluated before any allow;
+3. explicit denials are evaluated;
+4. typed allows and their enumerated conditions are evaluated;
+5. the default is deny.
+
+Rules contain selector values and bounded conditions only. They cannot execute scripts, perform regex evaluation, make outbound calls, or expand a project scope implicitly. A development selector matches only development; it does not imply production.
+
+The `Governance` boundary carries the same `InvocationContext` into the rate limiter and append-only audit sink. A permitted call emits one success or error event; a denied or rate-limited call emits one corresponding event. The audit projection stores a SHA-256 argument hash, redacted bounded arguments, matched rule IDs, and a sanitized decision trace. Credentials and authorization headers are never included.
+
+Connectors still perform their own project, environment, repository, document, and registered-container checks. Gateway policy is an additional boundary, not a substitute for connector authorization.