Last updated September 18, 2026
4 min read
A fictional one-line change moves a user identifier from an authentication service into an invoice query. The diff is tiny. The governance surface crosses identity, billing, privacy, and reporting. File count would route it as simple; module attribution reveals the actual decision. This is an explicitly fictional composite, not a customer result.
In this article
Files are not the same as product modules
A folder is a storage decision. A module is an ownership and behavior boundary. One file can serve several product concerns, and one business module can span controllers, jobs, events, policies, and documentation. Governance needs the latter map.
NIST AI RMF Core bounds this claim. Voluntary risk guidance, not certification or product proof.
| Evidence point | Interpretation |
|---|---|
| 1 | One file: small diff |
| 2 | Four modules: wide authority |
| 3 | Nearest rule: incomplete |
| 4 | Strictest floor: safer route |
Treat the table as a working diagnostic. Replace illustrative labels with repository evidence before making a budget, staffing, or release decision.
Cross-module impact changes the reviewer set
Build an affected-module set from the request, planned calls, changed symbols, data flows, and tests. Then attach owners and specialist roles. An invoice query that consumes identity data needs both billing and identity context even when only one repository path changed.
Order matters because later checks inherit the intent and scope established earlier. A skipped step does not remove uncertainty. It hands that uncertainty to a reviewer under time pressure.
Sensitivity floors follow the strictest surface
When modules disagree, use the strongest applicable floor. Authentication, billing, deletion, secrets, and production data should not be downgraded because the entry file looks harmless. Record the floor and the authority allowed to approve an exception.
Google DORA 2025 adds a second evidence boundary. Observational associations, not universal causation.
A procedural fix can be inspected, rehearsed, and improved. A warning without an owner or artifact usually disappears during the next busy sprint.
Make attribution a checked artifact
Store attribution in the plan and compare it with the final diff. A new import, event, database table, or API call can expand the module set during implementation. The check should reopen routing rather than silently accepting stale scope.
paqad-ai v1.67.0 was the current public release when this article was checked on July 21, 2026. Its repository describes risk routing, specialist roles, structured state, deterministic checks, documentation sync, and local audit records. These are product mechanisms, not independent outcome proof.
Use the AI workflow audit guide to map current practice, compare the bar with production-ready AI code, and use the AI coding consultant guide when the team needs outside ownership.
Decision rule: If any changed or called surface belongs to a stricter module, route the whole feature at that module’s sensitivity floor.
Run the module-attribution worksheet in a 45-minute working review with the product owner, module owner, and final reviewer. Do not turn it into a score. Read the decision rule aloud: If any changed or called surface belongs to a stricter module, route the whole feature at that module’s sensitivity floor. Record disagreements, missing evidence, and the person responsible for the next action. Repeat the review after one real feature so the team can compare whether the artifact reduced ambiguity or only added paperwork.
Frequently Asked Questions
What counts as a module?
Use a stable business or technical boundary with an owner, rules, tests, and documentation. A module may align with a folder, but do not assume the folder alone defines the boundary.
How do monoliths handle attribution?
Start with business capabilities and sensitive surfaces, then map their controllers, services, tables, jobs, and tests. The map can improve incrementally without waiting for an architectural rewrite.
Can attribution be fully automated?
Tools can propose modules from paths and symbols. A human still needs to confirm ambiguous product boundaries and consequences, especially where data or authorization crosses modules.
What next?
Apply the module-attribution worksheet to one current feature. If the repository cannot answer the questions it exposes, install paqad-ai and test a governed workflow with local evidence and explicit human authority.