> ## Documentation Index > Fetch the complete documentation index at: https://docs.domino.ai/llms.txt > Use this file to discover all available pages before exploring further. # Govern Apps > Govern Domino App versions: attach a policy bundle, collect evidence, obtain approvals, and clear the gates that block deployment until reviews finish. Governance puts an App through your organization's review before it reaches viewers. Because a [published version can't change](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/publish.md#why-version-defining-content-is-immutable), an approval covers exactly the code, environment, and data configuration that run. ## How governance works for Apps * **One live bundle per App, one snapshot per version.** You link the App to a governance bundle once. The bundle holds the policies, the evidence they ask for, and the approvals. When you publish a new version, the live bundle moves to it and the previous version keeps a read-only snapshot, so governance carries forward without re-collecting evidence. See [When you publish a new version](#when-you-publish-a-new-version). * **Gates decide whether a version runs.** A policy's gates block deployment until the approvals are in. Domino checks them on every deploy and restart, against the deployment parameters, so an approval can depend on where and how the version runs. See [How gates decide](#how-gates-decide). * **Policies can attach at any time.** You can govern an App at any point in its life. Policies your administrators enforce attach automatically. See [Required policies](#required-policies). ## Govern the App The **Synthetic Transaction Review** App puts a compliance decision in front of reviewers, so a model risk policy is likely to cover it. Attach the policy to the version you [published](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/publish.md) before you deploy it. You need a published version and policies [defined by a GovernanceAdmin](https://docs.domino.ai/cloud/platform-capabilities/features/governance/define-governance-policies). **1. Attach a policy** On the App's page, select **Add to Bundle** and link the App to a new or existing bundle. The App is now governed, and every later version reuses the bundle. **2. Collect evidence** Evidence for Apps usually covers security and data privacy. For the transaction review App, that might be a scripted check that only the compliance team can read the `AML` Dataset, plus a user acceptance testing (UAT) sign-off from a reviewer. * **Scripted checks**: Automated tests that verify dependencies, check for vulnerabilities, or validate data access permissions. * **Manual evidence**: Screenshots, UAT sign-offs, or Data Source documentation. [Use the Evidence notebook](https://docs.domino.ai/cloud/platform-capabilities/features/governance/work-with-bundles/use-evidence-notebook.md) describes how to record it. **3. Obtain approvals** Approvers review the evidence in the bundle and grant the approvals the policy requires. This is the same flow as for any other governed asset. **4. Deploy the version** [Deploy](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/deploy.md) the version. Domino checks the gates first, and blocks the deploy and lists any missing approval until it's granted. ## How gates decide Domino evaluates a gate each time someone deploys or restarts a governed version. * Gates match on deployment parameters such as Hardware Tier or Data Plane. A gate can allow CPU tiers and require a `Validation sign off` approval before the version runs on a GPU tier. * On restart, Domino returns an error if a previously approved configuration no longer meets the policy. * Preview instances of Draft Apps are never gated. Gates apply only in Projects where a bundle with gating policies is attached. [Gates](https://docs.domino.ai/cloud/platform-capabilities/features/governance/gating-domino-governance.md) describes how a GovernanceAdmin defines them in policy YAML. ## When you publish a new version Each governed version maps to one bundle. Governance carries forward to the new version without re-collecting evidence. On publish, Domino snapshots the previous version's bundle into a read-only bundle attached to the previous version. The snapshot copies evidence, attachments, and approvals, but not findings or comments. The read-write bundle moves to the new version. Approvals, findings, and attachments on earlier bundles stay editable. To see how evidence changed between versions, open the App and go to **Governance** > **Changes**. The tab compares evidence for the same policy across versions and shows what was added, removed, or modified. If a policy was upgraded between versions, the tab still pairs the bundles on that policy. If a policy exists in only one version, every question in it appears as added or removed. ## Required policies Governance admins can mark policies as enforced. Domino attaches enforced policies to every App bundle in the deployment, always at their latest version. Practitioners can't remove them. Governance, System, and Cloud admins can. | Event | What Domino does | | :- | :- | | New App | Creates the bundle with every enforced policy attached. | | New version of an ungoverned App | Creates a bundle with every enforced policy attached, if the App has none yet. | | New version of a governed App | Attaches any enforced policies missing from the bundle and upgrades attached enforced policies to their latest version. | If an admin removed an enforced policy from an earlier version's bundle, it attaches again on the next version as long as it's still enforced. See [Enforce required policies](https://docs.domino.ai/cloud/platform-capabilities/features/governance/define-governance-policies#enforce-required-policies). ## Related * [Work with bundles](https://docs.domino.ai/cloud/platform-capabilities/features/governance/work-with-bundles): Package assets for review. * [Define policies](https://docs.domino.ai/cloud/platform-capabilities/features/governance/define-governance-policies): Build the policies that govern Apps. * [Deploy to production](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/deploy.md): Start the approved version. ## Related topics - [Govern models, apps, agents, and files](https://docs.domino.ai/cloud/platform-capabilities/features/governance/work-with-bundles/govern-models-apps-files.md) - [Apps](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/index.md) - [App frameworks](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/develop-and-test/app-frameworks.md) - [Publish App versions](https://docs.domino.ai/cloud/platform-capabilities/core-concepts/apps/publish.md)