Skip to main content
Governance for Apps subjects an App to your organization’s review and approval workflows. Attach policies to an App to collect evidence, obtain approvals, and gate deployment. You can attach policies at any point in an App’s lifecycle, not only at creation.

​
How Apps and bundles work together

Each governed App version maps 1:1 to a bundle. Only the latest App version holds a read-write bundle; bundles attached to earlier versions become evidence read-only. Approvals, findings, and attachments on those earlier bundles remain editable. When you create a new version of a governed App, Domino:
  • Snapshots the previous version’s bundle by copying its evidence, attachments, and approvals into a new read-only bundle attached to the previous version.
  • Attaches the read-write bundle to the new version, so governance carries forward without re-collecting evidence.
Findings and comments are not copied to the snapshot, to avoid duplication.

​
Attach a policy to an App

  1. Open the App from Deployments > Apps & Agents.
  2. Click Add to Bundle to link the App to a new or existing bundle.
  3. Confirm the link in the bundle’s Attachments section.
Once a policy is attached, the App is governed. Its next version reuses the bundle automatically.

​
Collect evidence and obtain approvals

Evidence for Apps typically covers security and data privacy:
  • Scripted checks: Run automated tests to verify dependencies, check for vulnerabilities, or validate data access permissions.
  • Manual evidence: Provide screenshots, UAT sign-offs, or data source documentation.
Follow the same collection and approval flow used for other governed assets. Use the Evidence notebook has the details.
You can use gates to block the Deploy action when an App’s bundle is non-compliant. See Gates.

​
Compare evidence across App versions

Open a governed App and go to Governance > Changes to see how evidence has changed between versions. The Changes tab compares evidence for the same policy across each version’s bundle and shows what was added, removed, or modified.
  • If a policy was upgraded between versions, the tab still pairs the two bundles on the shared policy and marks any modified questions as added, removed, or changed.
  • If a policy is present in one version and missing in the other, every question in that policy appears as added or removed, depending on the direction of the comparison.

​
Required policies for Apps

Governance admins can define a set of policies that Domino attaches automatically to every App bundle, deployment-wide. Enforced policies always attach at their latest version, and practitioners cannot remove them from a bundle. Governance, System, and Cloud admins can remove one if needed. Enforcement runs when an App version is created:
  • New App: Domino creates the bundle with every currently enforced policy attached.
  • New version of an ungoverned App: If the App has no bundle yet, Domino creates one with every enforced policy attached.
  • New version of a governed App: Domino attaches any enforced policies that are missing from the bundle and upgrades already-attached enforced policies to their latest version.
If an admin removed an enforced policy from an earlier App version’s bundle, the policy attaches again on the next App version as long as it is still in the enforced set. See Enforce required policies for how admins configure the enforced set.

​
Next steps

Last modified on August 27, 2026

Related topics

Build and deploy AppsPublish and deploy App versionsGovern models, apps, agents, and filesAttach each App's mandatory policies to its governed bundle