Why must a policy rule carry a stable id and an owner, not just a title?

## A rule is referred to from places that do not contain it A policy rule is written once and then referenced from a dozen places that hold none of its logic. A waiver register says "this repository is exempt from that rule until the migration lands". A suppression sits in a manifest in a team's own repository. A row in a control map tells an auditor which running check stands behind which written control. A dashboard plots how often the rule fired last quarter. An alert routes its failures. A ticket template links to it. None of those hold the rule; all of them hold a **reference** to it. The id is that reference, and that is the entire argument for making it stable. ## Title versus id The **title** is one line of prose aimed at a person reading a build log. It is meant to be improved. "Container must not run as root" becomes "Containers must run as a non-root user" because somebody thought the second reads better. Nothing breaks, because nothing keys on it. The **id** is a machine-readable name - something like `licence-class` or `workload.runtime.non-root` - and it is the only thing other systems are allowed to match on. Change it and every reference breaks at once. The sharp part is that **most of those breakages are silent**: a waiver whose key matches no rule does not raise an error, it simply stops exempting anything; a control-map row pointing at an id nobody emits any more does not fail a build, it just stops describing reality; a dashboard filtered on the old id shows the violation count falling to zero, which reads like success. So the discipline is: the id is chosen once, never edited to fix a typo or improve wording, never reused for a different rule after the original is retired. Reuse is the worst of the three, because stale references do not merely stop matching - they start matching **different logic**, so an exemption written for one check silently begins excusing another. ## The metadata every rule carries A rule that is only logic is unusable at scale. The block around it typically carries: - **id** - stable, machine-readable, unique across the whole library, chosen with a namespacing scheme so two teams cannot mint the same name. - **title** - one line of human prose; free to change. - **description** - what the rule checks and, briefly, why the guardrail exists. - **owner** - a team handle, not an individual. This is the name a blocked engineer contacts and the name that answers when the rule turns out to be wrong. - **severity or class** - what the decision point does with the result, and how urgently anyone should care. - **remediation link** - a page that tells the person who was just blocked what to change. Not the rule source; the fix. A useful test for whether the metadata is real: can a developer who has never heard of the policy library read a single denial message and, without asking anyone, know what tripped, who owns it, and what to change? If the answer needs a Slack search, the metadata is decorative. ## Ids are an interface you publish Once a rule library has consumers - waivers, suppressions, control maps, reports - its ids are a published interface, exactly like a REST path or a column name. That has consequences a junior can already state: - Adding an id is safe. Changing one is a breaking change. - If an id genuinely has to change, the old one is kept as an alias for a deprecation window so both resolve, consumers are migrated, and only then is the old one retired. - Retirement is permanent. A retired id stays resolvable as "retired" rather than being handed to a new rule. ## Enforcing it in the library itself The rule repository's own checks are the cheapest place to hold the line: reject a rule with no owner, no remediation link, or an id that does not match the naming scheme; fail the build if two rules share an id; fail it if an id present in the previous release has vanished without a deprecation marker. That last check is what turns "please do not rename ids" from a convention people forget into something the library refuses to ship.